Generate a new key pair with `ssh-keygen -t ed25519 -C "your-email"`. ED25519 is the modern default over RSA — it produces smaller keys, generates and verifies faster, and is considered at least as secure as a much larger RSA key. RSA keys are still necessary for older systems that don't understand ED25519, but for any modern infrastructure, ED25519 is the right default. The `-C` flag adds a comment that helps identify the key later; using your email is a convention that makes sorting through multiple keys easier when you're trying to remember which key belongs to which device.

Copy the public key to a remote server with `ssh-copy-id user@server`, which handles appending the key to the correct file with the correct permissions automatically. Permissions on the `.ssh` directory and `authorized_keys` file matter — SSH will refuse to use keys if permissions are too permissive, as a security measure — and `ssh-copy-id` handles those without you having to think about them. If ssh-copy-id isn't available, the manual equivalent is `cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"`.

Don't lose track of your private keys, and back them up somewhere safe and access-controlled rather than only living on a single laptop. Generate a separate key pair for each device so that if one is lost or compromised, you can revoke access for just that key without rotating credentials across every server. And for the sake of your sanity, run an SSH agent so you're not retyping your passphrase on every connection. Typing a passphrase once per session is a reasonable tradeoff for security; typing it fifty times is not, and it's the kind of friction that eventually tempts people into removing the passphrase altogether, which defeats the point.