How Public and Private Keys Work Together
SSH uses a pair of keys that are mathematically connected. The public key is like a mailbox that anyone can see and use to send you encrypted messages. The private key is like the only key that opens that mailbox—it stays secret on your computer. When you try to log in to a remote server, the server uses your public key to create a challenge. Only your private key can answer that challenge correctly, which proves you are the legitimate owner of that key pair.
The Authentication Process
When you attempt to connect to a server via SSH, several steps occur automatically. First, the server checks if your public key is in its authorized list. Then the server generates a random challenge and encrypts it with your public key. Your SSH client uses your private key to decrypt this challenge and sends back the answer. If the answer is correct, the server knows you have the matching private key and grants you access. This entire process happens without any password being transmitted over the network.
Security Advantages Over Passwords
Password-based authentication is vulnerable because passwords can be intercepted, guessed, or cracked. With public key authentication, no password ever travels across the network, making interception impossible. Additionally, the mathematical complexity of the keys means they cannot be practically guessed or broken by brute force attacks. Even if a hacker captures all the network traffic from your login, they cannot use it to log in because the encrypted challenge changes every time you connect.
Protecting Your Private Key
Your private key is the most critical part of this system and must be kept secure. When you generate an SSH key pair, you can protect the private key with a passphrase—a password that encrypts the key itself. This means even if someone gains access to your computer's files, they cannot use your private key without knowing the passphrase. You should never share your private key with anyone, and you should store it only on computers you trust. Modern practice also recommends using keys of at least 2048 bits, with 4096 bits being more secure for sensitive systems.
Common Implementation Details
SSH keys are typically stored in a hidden folder on your computer called .ssh, and the standard key files are named id_rsa (private key) and id_rsa.pub (public key). You copy the public key to the remote server's authorized_keys file. Many systems also support multiple key pairs, allowing you to use different keys for different servers. Some organizations disable password authentication entirely and require all users to connect with public key authentication for maximum security. 
Answer