SSH Key Generator

Generate a real SSH key pair — Ed25519 (recommended) or ECDSA P-256/P-384 — in native OpenSSH format, ready to save as ~/.ssh/id_ed25519 (or id_ecdsa) and drop straight into authorized_keys on a server. Every key is created with a cryptographically secure random number generator right in your browser, so private key material never leaves your machine.

The private key comes out as a real -----BEGIN OPENSSH PRIVATE KEY----- file — the same container format ssh-keygen produces — and the public key as the standard one-line ssh-ed25519 AAAA... comment (or ecdsa-sha2-nistp256/ecdsa-sha2-nistp384) format authorized_keys and Git hosts expect. You also get the key's SHA-256 and MD5 fingerprints, the same ones ssh-keygen -l and most server logs show.

How to use it

1. Pick an Algorithm. Ed25519 is the modern default — small, fast, and the recommendation of virtually every current security guide.
2. Set a Comment (usually you@yourmachine) — it's stored in both files as a label, not a secret.
3. Click Generate key pair.
4. Download the private key and save it as ~/.ssh/id_ed25519 (chmod 600 it), and the public key as ~/.ssh/id_ed25519.pub (or append it to a server's ~/.ssh/authorized_keys).

Why isn't RSA offered?

The legacy version of this tool offered RSA 2048/4096 alongside Ed25519 and ECDSA. RSA key generation needs a large-prime search (Miller-Rabin primality testing over hundreds of random candidates), and there is no small, audited, dependency-light library for it that runs synchronously in both a browser and Node — the only isomorphic option is the Web Crypto API's crypto.subtle.generateKey, which is asynchronous and can't fit this tool's synchronous, engine-agnostic processing model. Hand-rolling RSA keygen from scratch is exactly the kind of large, security-sensitive undertaking not worth reimplementing for a browser tool. Ed25519 and ECDSA cover essentially every modern use case — GitHub, GitLab, and every current server both support and recommend them over RSA — so this is a deliberate scope reduction rather than a missing feature. If you specifically need an RSA key (for a legacy system that still requires one), generate it locally with ssh-keygen -t rsa -b 4096.

Which algorithm should I choose?

Use Ed25519 unless something forces your hand — shorter keys, faster signing, and it avoids several implementation pitfalls that have historically affected ECDSA. Use P-256 or P-384 only if a specific server or compliance policy requires NIST-curve ECDSA.

How do I use the generated key?

Save the private key exactly as downloaded (including the header/footer lines) to a file such as ~/.ssh/id_ed25519, then run chmod 600 ~/.ssh/id_ed25519 so SSH will accept it. Save the public key to ~/.ssh/id_ed25519.pub, or paste its contents into a server's ~/.ssh/authorized_keys file or your Git host's "add SSH key" form. Connect with ssh -i ~/.ssh/id_ed25519 user@host.

What are the SHA-256 and MD5 fingerprints for?

They're short, fixed-length digests of the public key — the same values ssh-keygen -l -f id_ed25519.pub prints. Servers and clients show them so you can visually confirm you're connecting to (or authorizing) the key you expect, without comparing the full public key text.

Privacy

Key generation happens entirely in your browser — the private key is never sent to a server, logged, or stored. Passphrase-encrypting the private key file is not performed by this tool; if you need the key protected at rest, encrypt it afterward with ssh-keygen -p -f <file>.