An SSH key comes in two halves: a private key that stays on your computer and a public key placed on the server (in ~/.ssh/authorized_keys). The server lets in whoever can prove possession of the private key — no password to guess or phish.
Keys are practically immune to brute-force guessing, which is why most security guides recommend disabling password logins entirely once keys work. Keep the private key safe and protect it with a passphrase.
Frequently asked questions
What happens if I lose my private key?
You can no longer log in with it. You (or your provider, via console access) must add a new public key — which is why keeping a second access path is wise.
Are SSH keys better than a strong password?
Yes — a key has hundreds of bits of entropy, cannot be phished like a password, and never travels to the server at all during login.