SSH key generator
Pick a key type and get a new SSH key pair. The keys are created by your browser's Web Crypto API on this device; they are not made on our server and are never sent anywhere. The public key is one line for authorized_keys or a Git host; the private key downloads as an OpenSSH file.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Leave the type on Ed25519 unless a server needs RSA.
- Optionally type a comment such as your email.
- Copy the public key or download the .pub file and add it to the server or Git host.
- Download the private key, save it in ~/.ssh with permissions 600, and add a passphrase with ssh-keygen -p.
A key pair is created when the page opens; press New key pair for another one.
How it works
The browser creates the key pair with Web Crypto: Ed25519 directly, RSA with public exponent 65537. The tool then writes the keys in OpenSSH’s own formats. The public key is the key type followed by a Base64 blob holding the type name and the key numbers. The private key is the “openssh-key-v1” container that ssh-keygen has written by default since OpenSSH 7.8, here without encryption.
Example
An Ed25519 public key line looks like this, with your comment at the end:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP… user@laptop
The private key file starts with -----BEGIN OPENSSH PRIVATE KEY-----. Running ssh-keygen -y -f id_ed25519 on it prints the same public key line, which is a quick way to check that the files belong together.
Tips
- One key per device is easier to revoke than one key copied everywhere.
- If a server rejects the key, check its sshd version and allowed key types; very old servers accept only RSA.
- Never send the private key to anyone. Only the .pub file is meant to be shared.
Frequently asked questions
Is it safe to generate an SSH key in a browser?
The key is made by the browser's built-in Web Crypto API from its secure random generator, the same one websites use for TLS. It is created in this tab and leaves it only when you copy or download it. If your policy requires keys made on the machine that uses them, run ssh-keygen there instead.
Should I choose Ed25519 or RSA?
Ed25519 is the default key type of current ssh-keygen and is widely accepted: short keys, fast, and strong. Pick RSA only for old servers or devices that do not accept Ed25519; then 3072 or 4096 bits is a reasonable size.
Where do I put the files?
On Linux and macOS save the private key as ~/.ssh/id_ed25519 (or ~/.ssh/id_rsa) and run chmod 600 on it, and save the .pub file next to it. Add the public key line to ~/.ssh/authorized_keys on the server, or paste it into your Git host's SSH key settings.
Why is there no passphrase option?
Encrypting an OpenSSH private key needs the bcrypt_pbkdf key derivation, which this tool does not implement. Run ssh-keygen -p -f with the file name after saving to add a passphrase; the key itself stays the same.
What is the fingerprint?
The SHA-256 hash of the public key in Base64, the same SHA256:… value that ssh-keygen -l and SSH clients show. Use it to confirm that a server or a Git host has the key you expect.