SSH key types (RSA / ED25519 / ECDSA) — what actually differs, and which one to pick

If you maintain WordPress sites over SSH — running wp-cli remotely, checking logs, transferring files with rsync — you're relying on SSH key authentication as the foundation. What rarely gets explained clearly is what you're actually choosing when ssh-keygen -t asks for an algorithm. This post walks through what RSA, ECDSA, and ED25519 actually rest on mathematically, and which one makes sense to pick today.

Note: SSH key authentication uses public-key cryptography. You keep a private key on your machine (never shared) and place a public key on the server (safe to share). The server issues a challenge that only the matching private key can answer, so you prove who you are without ever sending a password.

What actually differs between the three types

The main options you'll see with ssh-keygen -t <algorithm> are:

Type