Chapter 6.2 — SSH vs HTTPS Setup☕ 15 min read

SSH vs HTTPS Setup

SSH = VIP pass. Ek baar lagao, har baar bina roko jaao.

01The Authentication Problem

Every time you push or pull to a private remote repository, Git requires you to prove who you are. This is authentication.

Two methods dominate: HTTPS and SSH.

HTTPS uses a username and password for authentication. But since August 2021, GitHub no longer accepts your account password for Git operations. Instead, you must use a Personal Access Token (PAT) — a long string you generate from GitHub settings.

SSH uses a public/private key pair. You generate a key pair once, add the public key to GitHub, and then you never enter credentials again. Your private key handles authentication automatically.

Both methods work perfectly. But SSH is the professional standard for developers who push code daily.

# HTTPS — requires credentials every time (or credential manager)
git clone https://github.com/user/repo.git
# Username: your-username
# Password: ghp_xxxxxxxxxxxx (PAT, not your real password!)

# SSH — no credentials needed after setup
git clone git@github.com:user/repo.git
# Cloning directly, no password prompt!

# Check what your repo uses
git remote -v
# origin  https://github.com/user/repo.git (HTTPS)
# origin  git@github.com:user/repo.git (SSH)

Quick check: Look at the remote URL. Does it start with https://? That is HTTPS. Does it start with git@? That is SSH. The URL tells you which authentication method Git will use.

02HTTPS: Easier Start, More Hassle Later

HTTPS is the easiest way to start with Git. It works everywhere — behind corporate firewalls, proxies, and restricted networks. It uses port 443 (standard web traffic), which is almost never blocked.

The catch: GitHub deprecated password authentication for HTTPS in August 2021. You must now use a Personal Access Token (PAT).

Generate a PAT: GitHub → Settings → Developer settings → Personal access tokens → Generate new token. Select the scopes you need (at minimum: repo) and set an expiration.

Without a credential manager, you must enter your PAT on every single push and pull. This gets old fast.

Git provides credential helpers to cache your PAT:

credential.helper cache — stores in memory for a limited time (default 15 min)
credential.helper store — stores permanently in plain text on disk (security risk!)
osxkeychain (Mac) / manager-core (Windows) — uses encrypted OS storage

# Generate a PAT on GitHub
# Settings → Developer settings → Personal access tokens → Generate new token
# Select scopes: repo, workflow, etc.

# Clone with HTTPS
git clone https://github.com/user/repo.git
# Prompts for username and PAT

# Cache credentials for 1 hour (in memory)
git config --global credential.helper cache --timeout=3600

# Store credentials permanently (PLAIN TEXT — less secure)
git config --global credential.helper store

# Mac: use osxkeychain (secure)
git config --global credential.helper osxkeychain

# Windows: use Git Credential Manager (installed with Git for Windows)
# Usually auto-configured

# Change remote URL from SSH to HTTPS
git remote set-url origin https://github.com/user/repo.git

💡 Pro Tip: If you must use HTTPS on a shared machine, use credential.helper cache (memory only) instead of store (plain text on disk). On your personal Mac, osxkeychain is secure and convenient. On Windows, Git Credential Manager handles it automatically.

03SSH: Setup Once, Never Type Password Again

SSH uses public-key cryptography. You have a private key (never share this) and a public key (add to GitHub). When you push or pull, Git uses your private key to prove your identity — without sending any password.

Setup is a one-time process with six steps:

Step 1: Generate an SSH key pair with ssh-keygen -t ed25519
Step 2: Start the SSH agent with eval "$(ssh-agent -s)"
Step 3: Add your key to the agent with ssh-add ~/.ssh/id_ed25519
Step 4: Copy your public key to clipboard
Step 5: Add the public key to GitHub (Settings → SSH and GPG keys)
Step 6: Test with ssh -T git@github.com

ed25519 is the modern, secure key type. Older tutorials may show rsa, but ed25519 is faster and more secure.

Limitation: SSH uses port 22, which some corporate networks block. Use HTTPS as a fallback in those cases.

# Step 1: Generate SSH key (use ed25519 — modern standard)
ssh-keygen -t ed25519 -C "your@email.com"
# Press Enter for default location
# Set a passphrase (optional but recommended)

# Step 2: Start ssh-agent
eval "$(ssh-agent -s)"
# Agent pid 12345

# Step 3: Add key to agent
ssh-add ~/.ssh/id_ed25519
# Enter passphrase if you set one

# Step 4: Copy public key to clipboard
cat ~/.ssh/id_ed25519.pub
# Or on Mac: pbcopy < ~/.ssh/id_ed25519.pub
# Or on Windows: cat ~/.ssh/id_ed25519.pub | clip

# Step 5: Add to GitHub
# GitHub → Settings → SSH and GPG keys → New SSH key
# Paste the public key

# Step 6: Test connection
ssh -T git@github.com
# Hi username! You have successfully authenticated

# Step 7: Change remote URL to SSH
git remote set-url origin git@github.com:user/repo.git

💡 Never share your PRIVATE key (id_ed25519). Only share the PUBLIC key (id_ed25519.pub). The private key proves your identity — if someone gets it, they can access all your GitHub repos. Treat it like your house key.

04Switching Remote URLs

You can switch between HTTPS and SSH anytime using git remote set-url. The repository data is identical — only the authentication method changes.

Check your current remote URL:

git remote -v
# origin  https://github.com/user/repo.git (HTTPS)

Switch to SSH:

git remote set-url origin git@github.com:user/repo.git
git remote -v
# origin  git@github.com:user/repo.git (SSH)

Switch to HTTPS:

git remote set-url origin https://github.com/user/repo.git
git remote -v
# origin  https://github.com/user/repo.git (HTTPS)

If SSH is blocked by your corporate network, switch to HTTPS temporarily. When you are back on an open network, switch back to SSH. Your commits, branches, and history remain unchanged.

# Test push after switching
git push origin main
# Should work with the new authentication method

05Security Best Practices

Never commit secrets — your private SSH key, PAT, or .env files should NEVER be in a repository.

Use a passphrase on your SSH key. If your laptop is stolen, the key is useless without the passphrase. Use ssh-agent to avoid typing it every time.

PATs should have minimum required scopes (permissions). Do not generate a token with full access if you only need to push code.

Set expiration on PATs — 30, 60, or 90 days. Rotate regularly.
credential.helper store saves credentials in PLAIN TEXT — avoid on shared machines.
Use hardware security keys (YubiKey) for maximum GitHub account security.

# BAD: Storing credentials in plain text
git config --global credential.helper store
# Saved in ~/.git-credentials as plain text!

# GOOD: Cache in memory temporarily
git config --global credential.helper cache --timeout=3600

# GOOD: Use SSH with passphrase
ssh-keygen -t ed25519 -C "your@email.com"
# Enter passphrase: ********
ssh-add ~/.ssh/id_ed25519  # unlocks for the session

# GOOD: Limit PAT scopes
# When generating PAT on GitHub, only check:
# ✅ repo (full control of private repositories)
# ❌ admin:org (usually not needed)
# ❌ delete_repo (dangerous!)
# Set expiration: 90 days

# GOOD: Test your security
ssh -T git@github.com  # verify SSH works
git push origin main   # verify push works

GitHub shifted from passwords to PATs in August 2021. Your GitHub login password NO LONGER works for Git operations over HTTPS. You MUST use a Personal Access Token. Think of a PAT as a password specifically for Git — you generate it from GitHub settings, give it specific permissions, and set an expiration. Store it safely; you will not see it again after generation.

Lo kar liya — Key Points:

✅ HTTPS uses Personal Access Tokens (PATs) for authentication; GitHub no longer accepts account passwords for Git operations
✅ SSH uses public/private key pairs; set up once and never type credentials again
✅ Generate SSH key with ssh-keygen -t ed25519 and add the public key to GitHub
✅ Switch between HTTPS and SSH using git remote set-url origin
✅ Never share your private SSH key; protect it with a passphrase
✅ credential.helper store saves credentials in plain text — avoid on shared machines
✅ SSH uses port 22 which may be blocked by corporate firewalls; use HTTPS as a fallback

Previous6.1 — Clone, Fetch, Pull & Push 📋 All Chapters Next Chapter6.3 — Pull Requests →