Where apps hide your files

What is inside ~/.ssh and what each file does

Updated 2026-10-28 · 6 min read

Your keys, known hosts and settings all sit in one hidden folder in your home directory. Here is what each file is, which ones are safe to share, and how to move them.

The folder

~/.ssh/

That is your home folder's hidden .ssh directory, for example /Users/yourname/.ssh. It is where the ssh command looks for your keys and settings. It may not exist until you create a key or connect to a server for the first time.

In Terminal, list the names (this shows file names and permissions, not contents):

ls -la ~/.ssh

In Finder, press ⇧⌘G and type ~/.ssh. The folder is hidden, so you will not find it by browsing your home folder unless you press ⇧⌘. to show hidden items.

Only open these files in an editor when you know what you are editing, and never paste a private key into chat, email or a ticket.

Which file is which

File	What it is	Share it?
id_ed25519, id_rsa, id_ecdsa	Your private key. The default name depends on the key type	Never
id_ed25519.pub and similar	The matching public key, one line of text	Yes, this is what you give to GitHub or a server
config	Per-host settings: user name, key to use, port, aliases	Usually fine, but check for internal host names
known_hosts	Fingerprints of servers you have connected to before	No need
known_hosts.old	The previous copy, saved when ssh-keygen -R or -H rewrites known_hosts	No need
authorized_keys	Public keys allowed to log in to this Mac, if you turned on Remote Login	No need

Keys can have any name. A file called id_rsa_work or deploy_key is almost certainly a private key if a file of the same name plus .pub sits beside it. The .pub file is always the safe one to look at.

To confirm which key a public file belongs to, without touching the private half:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

That prints the key size, a fingerprint and the comment. Replace the file name with yours.

Permissions that ssh insists on

ssh ignores a private key that other accounts can read, and warns "UNPROTECTED PRIVATE KEY FILE". The modes the OpenSSH manual recommends are:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

Substitute your key's name. Public keys can be readable by anyone. The config file can be readable but must not be writable by other accounts, and private keys should show -rw------- in the ls -la listing.

How the config file works

~/.ssh/config is a plain text file with blocks like this:

Host myserver
    HostName server.example.com
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    AddKeysToAgent yes
    UseKeychain yes

With that block, ssh myserver does the rest. On macOS, UseKeychain yes together with AddKeysToAgent yes lets the key's passphrase be stored in your login keychain, so you are not asked each time. The setting is specific to Apple's build of OpenSSH. Other systems will reject it unless you also add IgnoreUnknown UseKeychain at the top.

Git hosts use the same file. If a repository fails with "Permission denied (publickey)", the IdentityFile line, or the absence of one, is where to look first.

System-wide files, outside your home folder

Settings that apply to every user live in /etc/ssh/:

/etc/ssh/ssh_config      client defaults, applies to everyone
/etc/ssh/ssh_config.d/   extra client files, included by ssh_config
/etc/ssh/sshd_config     the server, used when Remote Login is on

Your personal ~/.ssh/config is read first, and for each setting the first value ssh finds wins. Apple's ssh_config includes every file in ssh_config.d, which is where VPN and device management tools can drop their own rules (on the Mac used for this guide, a VPN client had added one), so check it if ssh behaves unexpectedly with a host you never configured. On a Mac, /etc is a link to /private/etc.

The ssh-agent

When a passphrase-protected key is loaded, it is held by ssh-agent, which macOS starts for you through launchd. Its socket path appears in the SSH_AUTH_SOCK environment variable (echo $SSH_AUTH_SOCK), in a folder under /private/tmp/com.apple.launchd.. List the loaded keys with ssh-add -l, which prints fingerprints only. Load one into the keychain with ssh-add --apple-use-keychain ~/.ssh/id_ed25519.

Creating, backing up and moving keys

Create a new key rather than copying an old one when you can:

ssh-keygen -t ed25519 -C "you@example.com"

Accept the default location, which is ~/.ssh/id_ed25519, and set a passphrase. Then add the .pub file's content to the service that needs it.

To move to a new Mac, you can copy the private key and its .pub into ~/.ssh there, using an encrypted drive or a password manager rather than email or cloud chat, then reapply the permissions above. The cleaner route is a fresh key on the new Mac, added to your accounts, then removed from the old one once you are done. Time Machine backups contain ~/.ssh as well, so treat a backup disk as holding your private keys.

Do not delete a key you still use to reach servers. Removing known_hosts is harmless but makes ssh ask you to trust each host again. If ssh warns that a host key has changed, remove only that line with ssh-keygen -R <hostname>, after you confirm the change is expected.

Why you cannot find them in a search

.ssh is a dot-folder, and Spotlight does not return hidden folders. Keys also have no fixed extension, so a search by type finds nothing.

Finding odd key files next time

A key you generated years ago may have a name only you chose, or sit outside ~/.ssh in a project folder or an old backup. In Everywhere, typing id_ lists every file whose name starts that way, and typing .pub lists each public key, which is how you spot the private partner next to it; keys in Documents, on the Desktop or on a backup drive are included once it has Full Disk Access. Press ⌘↵ to reveal the file in Finder. It only reads file names, never the contents of a key.

Common questions

Where is the SSH key location on a Mac?

In ~/.ssh, a hidden folder in your home directory. Default key names are id_ed25519 and id_rsa, with the public half ending in .pub.

Why can't I see the .ssh folder in Finder?

It is a hidden dot-folder. Press Shift-Command-period to show hidden items, or use Go to Folder (Shift-Command-G) and type ~/.ssh.

Does ~/.ssh exist by default on a new Mac?

Not always. It is created when you generate a key with ssh-keygen or connect to a host for the first time, which creates known_hosts.

Where is the system-wide SSH config on macOS?

In /etc/ssh/ssh_config, with extra files in /etc/ssh/ssh_config.d/. Your own ~/.ssh/config takes priority over them.