What this does
Builds a single, correctly indented Host block for ~/.ssh/config from plain fields instead of remembering the exact directive names and syntax — the six directives that come up in almost every real config: User, Port, IdentityFile, ProxyJump, and ForwardAgent, under the Host alias you connect with. Every field is optional except Host itself — leave the rest blank and only the lines you actually need get generated.
What each field means
- Host — the alias you'll actually type:
ssh myservermatches a block whoseHostline ismyserver. If nothing else in the block overrides it, ssh treats this value as the address to connect to as well. - User — the remote username, so
ssh myserverworks without typingssh alice@myserverevery time. - Port — only needed when the server doesn't use the default port 22, common on hardened servers or when several services share one IP through different ports.
- IdentityFile — which private key to offer for this host. List more than one line to have ssh try each key in order until one is accepted.
- ProxyJump — routes the connection through an intermediate host first, for servers only reachable from inside a private network via a bastion.
- ForwardAgent — lets the remote host use your local SSH agent to authenticate onward to other servers, without copying your private key there. Real security tradeoff below.
Examples
Click any preset above the form to load it, or use these as a reference:
# A server reachable directly, using a dedicated key
Host myserver
User alice
IdentityFile ~/.ssh/id_ed25519# Only reachable through a bastion host on the edge of the network
Host internal-db
User deploy
IdentityFile ~/.ssh/id_ed25519
ProxyJump bastion.example.com# GitHub over SSH, with a key used only for this
Host github.com
User git
IdentityFile ~/.ssh/id_ed25519_githubThe ForwardAgent tradeoff
Turning this on means a remote host can use your local agent's loaded keys to authenticate to other servers, without your private key ever being copied there — useful for hopping from a jump host to a server behind it without keeping a copy of your key on the jump host. The tradeoff: anyone with root access on that remote host, for as long as your session is connected, can use your agent the same way you can. Turn it on only for hosts you fully trust, and never as a default for every host.
FAQ
What does the Host line actually do?
It's a pattern matched against whatever you type after "ssh" on the command line — not necessarily a real address. "Host myserver" means running "ssh myserver" applies this block; if no HostName is set underneath it, ssh uses the Host value itself as the address to connect to.
Do I need HostName if I already set Host?
Only if the alias should differ from the real address. "Host prod" with no HostName means ssh prod connects to a machine literally named prod; add "HostName 203.0.113.5" underneath it to make prod a friendly alias for that IP instead.
Is ProxyJump the same as the old ProxyCommand trick?
They accomplish the same thing — routing a connection through an intermediate host — but ProxyJump (added in OpenSSH 7.3) is a single clean directive, while the older approach required a full ProxyCommand line invoking ssh -W manually. Use ProxyJump for any new config.
Should I turn on ForwardAgent?
Only for hosts you trust completely. It lets that remote machine use your local SSH agent to authenticate onward to other servers, which means anyone with root on that remote machine can use your loaded keys for as long as your session is open.
Can one config file have more than one Host block?
Yes — a real ~/.ssh/config is normally a list of many Host blocks, one per alias, sometimes followed by a catch-all "Host *" block for settings that should apply everywhere. This tool generates one block at a time; add more by generating again and appending.
Where does this file actually go?
~/.ssh/config on Linux and macOS (create the file if it doesn't exist yet); on Windows, the same path under your user profile if you're using OpenSSH's built-in client. No restart or reload is needed — ssh reads it fresh on every connection.
Try it yourself
Need a key to reference in IdentityFile? SSH Key Generator makes one. For the full picture of how SSH key authentication and this config file fit together, see SSH Config File Guide.