If you've been generating SSH keys for years without thinking about the type, there's a good chance you've been generating RSA keys — it's been ssh-keygen's default forever, it works everywhere, and nobody's getting in. All true. But "works everywhere" and "best choice" aren't the same thing, and Ed25519 has quietly made RSA the legacy option for most use cases.
RSA: the one that's been everywhere
RSA is based on the difficulty of factoring large integers. The security comes from key size: a 2048-bit RSA key is considered the minimum acceptable today; 4096-bit is what cautious security teams specify. The tradeoffs are concrete:
- Key size matters a lot. There's no meaningful "small RSA key" — 1024-bit RSA was broken (by practice, not just theory) and 2048-bit is holding but won't last indefinitely. Every few years the minimum recommendation ratchets up.
- Performance scales with key size. A 4096-bit key is meaningfully slower to generate and to use than a 2048-bit one — not catastrophically slow, but enough to notice in automation pipelines creating thousands of keys.
- It's universally supported. Every SSH server and client that has ever existed speaks RSA. That's relevant when you're connecting to ancient embedded devices, legacy appliances, or SSH servers that haven't been updated in a decade.
Ed25519: the current recommendation
Ed25519 is an elliptic curve signature algorithm (specifically Edwards-curve DSA using Curve25519). Its public keys are exactly 32 bytes — the entire SSH public key is one short line, versus RSA's multi-line base64 block. That size difference isn't cosmetic:
- 256-bit security with a 256-bit key. Elliptic curves achieve equivalent security with much smaller keys because the underlying math problem (discrete logarithm on an elliptic curve) is harder to attack than integer factorization at equivalent key sizes.
- Fast and constant-time by design. Curve25519 was designed from the start to avoid the timing side channels that have plagued other curve implementations. The reference implementation runs in constant time regardless of input, which is the kind of property that matters when security researchers probe your server.
- No fragile parameters. RSA implementations have failed when developers chose weak prime generation. Ed25519 has no such parameters to mischoose.
- Compact signatures and fast verification. Ed25519 signature operations are among the fastest in any common algorithm, which matters for SSH connections that need to complete quickly and in automated environments where keys are verified constantly.
The one catch: very old SSH servers (pre-OpenSSH 6.5, circa 2014) don't support Ed25519. If you need to reach legacy infrastructure, check the server's version before committing to Ed25519.
ECDSA P-256/P-384: the middle ground
ECDSA (Elliptic Curve DSA) using NIST P-256 or P-384 curves offers elliptic-curve performance and key size like Ed25519, with broader compatibility on systems that support ECDSA but not Ed25519 (some HSMs, FIPS-compliant environments, older macOS versions before system OpenSSH was updated). It's a reasonable choice when you need elliptic curve keys but have an interoperability constraint Ed25519 doesn't satisfy.
The knock on ECDSA: it requires a random number per signature, and a weak or reused nonce can leak the private key. This is a well-understood failure mode (it's how the PS3's signing key was extracted), and modern implementations handle it correctly, but it's an implementation footgun Ed25519's design avoids entirely.
DSA: don't
DSA keys were deprecated in OpenSSH 7.0 (2015) and disabled by default since OpenSSH 9.8 (2024). Nothing new should be generating or accepting DSA keys.
The practical answer
| Situation | Key type | | --- | --- | | New key for modern infrastructure | Ed25519 | | Legacy server that doesn't support Ed25519 | RSA 4096-bit | | FIPS environment or HSM requiring ECDSA | ECDSA P-256/P-384 | | Ancient appliance, embedded device | RSA 2048-bit minimum |
Generate one now
Our SSH Key Generator produces Ed25519 and ECDSA P-256/P-384 keys in native OpenSSH format — the same output ssh-keygen produces — with SHA-256 and MD5 fingerprints included. Everything runs in the browser; private key material never leaves your machine. If you need RSA or general asymmetric key pairs for non-SSH purposes, the RSA Key Generator covers 1024 through 4096-bit keys in PEM and DER formats.