Always remember the relevant files and folders must have non-public permissions, otherwise there will be ambiguous error messages and absolute failure.
No need to have SSH access in order to use an SSH key for just SFTP because the key can be transferred by SFTP to the appropriate path.
The passphrase is recommended as at least 10–30 characters, any characters, therefore a phrase more so than a word.
Possible to have an empty passphrase, which then results in no need to unlock the key each time, therefore login needs only username and destination. Either way, a single key can be for many different uses. The former contradicts the typical recomendation of always having a strong password, and the latter contradicts never using the same authentication anywhere else.
On the other hand, an SSH key allows for access to an account while neither needing nor revealing the account password. That means nothing that requires the password can be done in the account when only the key is known.
Generate a key with the latest format using -o. Use -b to specify the number of bits; 1024 is minimum, 2048 is default. The comment is set with -C, since the default is something like "user@host.local".
ssh-keygen -o -t rsa -C "description"
Or change comment afterwards with -c.
ssh-keygen -c
Obscure the hostnames and addresses in the "known_hosts" file.
ssh-keygen -H
Either copy the key to "~/.ssh/authorized_keys" on the other host, or use the ssh copy command to have it appended automatically (optionally specifying the server).
ssh-copy-id -i ~/.ssh/id_rsa.pub user@[server.]domain.tld
Test the connection.
ssh login@machine.domain.tld
Change passphrase.
ssh-keygen -p
Generate a new host key and replace the current key. Useful when the remote host identification has changed.
ssh-keygen -R domain.tld