Docs

Elastic Compute Service

Key pairs

Overview of key pair

Overview

An SSH key pair is a secure authentication method for instance login, distinct from username-password authentication. This method is supported exclusively for Linux instances.

An SSH key pair uses asymmetric encryption and, by default, is generated by using RSA 2048-bit encryption. The key pair consists of a public key and a private key. A data encryptor uses the specified encryption algorithm and public key to encrypt plaintext, producing unreadable ciphertext. A data decryptor decrypts the ciphertext by using the corresponding private key (following the same encryption algorithm) to retrieve the original plaintext.

SSH advantages

The following items describe the advantages of using an SSH key pair to log in to an instance:

Higher security: SSH key pairs use an asymmetric encryption algorithm. Only users who possess the private key can log in to the instance, which greatly enhances security.

Password-free login: When you log in to an instance by using an SSH key pair, you do not need to enter a password, eliminating the risk of password cracking or theft.

Convenience: A single SSH key pair can be used across multiple ECS instances, simplifying the management and access of multiple instances.

In general, compared with passwords, SSH key pairs provide a more secure and convenient method for logging in to instances. This method is ideal for scenarios where frequent instance logins are required or high security requirements must be met.

Limits

You can use an SSH key pair to log in to Linux instances only, and only as the root administrator or a custom user.

Currently, ECS allows you to create only 2048-bit RSA key pairs.

An account can have up to 500 key pairs in a region.

Key pair names must be unique within the same account.

You can associate a Linux instance with only one key pair in the ECS console. If you want to use multiple key pairs to log in to the same instance, you can modify the ~/.ssh/authorized_keys file within the instance to add multiple key pairs.

You can associate or disassociate a key pair with up to 50 instances at the same time. However, there is no limit on the maximum number of instances that a single key pair can be associated with or disassociated from.

Usage notes

After you create an SSH key pair, the platform saves the public key of the SSH key pair. In Linux instances, the public key is stored in the ~/.ssh/authorized_keys file. However, you need to download and securely store the private key. You have only one opportunity to download the private key. The ECS console does not retain your private key. Make sure that the private key is properly safeguarded.

tip

For information about how to view the public key, see Viewing public key information.

Operation guide

To log in to a Linux instance by using an SSH key pair, you need to first have a key pair. You can either specify the key pair when you create the instance or associate the key pair with the instance after the instance is created. Then, you can use the downloaded private key to log in to the instance.

Applicable scenarios	Reference
If no key pair is available, you need to create a key pair consisting of a public key and a private key. When you log in to the instance, provide the private key for authentication.	Creating key pairs
You can associate a key pair with an instance to address your requirements for secure login, multi-user access management, automation, and batch operations.	Associating instances with key pairs
After you associate a key pair with an instance, you can log in to the instance by using key-based authentication.	Using the console to log in to a Linux instance
You can view the key pairs that have already been associated with an instance on the instance details page or the key pair list page.	Viewing instances associated with key pairs
To change the key pair associated with an instance or to switch the login credentials from key pair to password, you need to first disassociate the original key pair from the instance.	Disassociating instances from key pairs
If you no longer use a key pair, you can delete it.	Deleting key pairs
You can retrieve the content of a public key either to create a key pair or to add multiple public keys to an instance, enabling login to that same instance by using multiple key pairs.	Viewing public key information
Within a Linux instance, you can add multiple public keys to support logging in to the same instance with multiple key pairs, or replace the existing key pair entirely.	Adding or replacing key pairs within instances

FAQs

Can I use key pairs to log in to Linux instances and Windows instances?

Why cannot I associate a key pair with an instance?

How do I use a local key pair to log in to a Linux instance?

Why cannot I log in to a Linux instance by using a local key pair?

How can I log in to an instance if I lose the private key of my key pair?

Last updated: 2026.06.18 17:49:49