Passwords have one big weakness: someone can guess them. Brute force attacks do exactly that, trying thousands of passwords until one works. Your server logs may already show some visitors trying their luck.

SSH key-based login offers a better way. You create a pair of keys. The private key stays on your computer and is never shared. The public key goes on the server. When you connect, your computer proves it holds the private key without ever sending it. There is no password to sniff and nothing for a bot to guess.

Protect the private key with a passphrase, store it somewhere sensible, and never email it or put it in a shared folder. Treat it like the keys to the building, not a spare for the neighbour.

Keys work with SFTP, so your FTP client can use them. FileZilla, WinSCP and Cyberduck all support them.

On the first connect, check the host key fingerprint, since that confirms you are talking to the real server. Then enjoy logging in without typing anything, which feels slightly like magic and is much more secure.

Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task.