SSH & Keys

SSH Config Builder

SSH Config

SSH Configuration Builder

Configure your SSH hosts with essential settings. Expand advanced options for tunneling, proxies, and security configurations.
1
example-server
No hostname configured
Basic Connection Settings

Authentication
Security Options
Connection Options
Proxy & Tunneling

Use %h for hostname and %p for port

local_port remote_host:remote_port

remote_port local_host:local_port

Local SOCKS proxy port

Tool features

Build SSH configuration files with advanced options
4 features

Guided builder

Produces valid config syntax without memorising directive names

Multiple hosts

Any number of independent Host blocks in one file

Advanced options

Port forwarding, proxy commands, keepalives and host key checking

Copy or download

Export a ready-to-use ~/.ssh/config file

What ~/.ssh/config does & how it works

Per-host settings that ssh, scp, rsync and git all obey

~/.ssh/config is where you stop retyping connection details. Instead of ssh -i ~/.ssh/prod_key -p 2222 deploy@10.0.4.19, you define a Host block once and connect with ssh prod. Every option below the Host line — port, user, key, timeouts, forwarding — applies automatically to that alias.

The same file drives more than convenience. ProxyJump reaches machines that are only accessible through a bastion, LocalForward and DynamicForward set up tunnels that open with the connection, and ServerAliveInterval keeps long sessions from dropping. Anything ssh reads from this file, scp, rsync and git read too.

Host
The alias you type: ssh prod. Wildcards like Host *.internal apply settings to a whole group.
IdentityFile
The private key for this host. Pinning it stops SSH from offering every key you own to every server.
ProxyJump
Reach a host through a bastion in one hop — the modern replacement for a hand-written ProxyCommand.
ServerAliveInterval
Seconds between keepalive probes. Set it when idle sessions get dropped by a firewall or NAT.

How to use this tool

Build an SSH config file in five steps
1
Name the host
Set a Host alias you will actually type — prod, bastion, db-replica — then the real Hostname or IP behind it.
2
Set user, port and key
Fill in the login user, a non-standard Port if the server uses one, and the IdentityFile path for the key that host accepts.
3
Add advanced options if you need them
Agent forwarding, compression, keepalives, strict host key checking, and local, remote or dynamic port forwarding are all optional — leave them alone unless you have a reason.
4
Add more hosts
Repeat for each server. Entries are independent, so a per-host setting never leaks into the others.
5
Install the config
Copy or download the result to ~/.ssh/config and run chmod 600 ~/.ssh/config. Test with ssh -v your-alias.

Related tools

Keep debugging with tools from the same suite
3 tools
SSH Tunnel Helper
Generate SSH tunnel commands for secure port forwarding and proxy setup
Git SSH Config Generator
Generate SSH configuration for Git repositories and multiple SSH keys management
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication

Frequently asked questions

Common questions about SSH client configuration
8 Q&A

Per-user settings go in ~/.ssh/config (C:\Users\<you>\.ssh\config on Windows). System-wide defaults live in /etc/ssh/ssh_config. Run chmod 600 ~/.ssh/config after saving — SSH ignores a config file writable by other users.

Two usual causes. First, permissions: chmod 600 ~/.ssh/config and chmod 700 ~/.ssh. Second, ordering — SSH applies the first value it finds for each option, so a broad Host * block placed at the top will win over the specific block below it. Put specific hosts first and wildcards last. ssh -v alias shows what is actually being applied.

LocalForward opens a port on your machine that tunnels to a host reachable from the server — the usual way to reach an internal database. RemoteForward does the reverse, exposing one of your local ports on the server. DynamicForward turns the connection into a SOCKS proxy that can reach anything the server can.

Use ProxyJump bastion-alias on the inner host's block, where bastion-alias is another Host entry in the same file. SSH connects to the bastion and opens the second hop through it automatically. ProxyJump replaced the older ProxyCommand ssh -W %h:%p ... incantation.

Almost never. It is the check that detects a server's key changing underneath you, which is what a man-in-the-middle looks like. Turning it off for ephemeral CI or lab hosts that are rebuilt constantly is defensible; turning it off for anything long-lived removes a real protection for a small convenience.

Yes. ForwardAgent yes lets anyone with root on the remote host use your loaded keys for as long as you are connected. Enable it only for hosts you trust, and prefer ProxyJump when all you actually need is to reach a machine behind another one.

Yes — Host accepts patterns, so Host *.internal.example.com applies to every matching name, and you can list several patterns on one line. A trailing Host * block is the conventional place for global defaults.

No. The config is assembled in your browser and never leaves it. It also only references key paths such as ~/.ssh/id_ed25519, so no key material is involved at any point.