SSH Key Generator
Generate real Ed25519, RSA, or ECDSA SSH key pairs using your browser's native Web Crypto API — get OpenSSH-format public/private keys, fingerprints, and randomart instantly. Your private key is generated locally and never transmitted anywhere.
Generate an SSH Key Pair
Choose an algorithm, add an optional comment, and generate — everything runs locally in your browser.
Please update to a current version of Chrome, Firefox, Edge, or Safari to use this tool.
✅ Ed25519 is fast, produces short keys, and is supported by GitHub, GitLab, and virtually every modern server — the best default choice.
ssh-keygen -p -f your_key locally to add one using OpenSSH's own trusted tooling.
📄 Public Key (share this)
🔒 Private Key (keep this secret)
📦 PKCS8 PEM (for non-SSH tools)
Standard PEM format used by TLS/crypto libraries, not typically needed for ssh/git.
🛡️ Secure handling recommendations
- Never share your private key — treat it exactly like a password.
- Store it under
~/.ssh/with permissions restricted to your user (chmod 600). - Add a passphrase with
ssh-keygen -p -f your_keyfor keys used on shared or portable devices. - Prefer Ed25519 for new keys unless you have a specific legacy-compatibility need.
- Rotate keys periodically and immediately if you suspect exposure.
How This SSH Key Generator Works
This tool generates real key pairs using your browser's native Web Crypto API — the same standardized cryptographic engine every modern browser ships for TLS, WebAuthn, and other security-critical features. It does not implement its own key-generation cryptography; it only adds the OpenSSH wire-format encoding (byte packing and base64) around the key material your browser generates, entirely on your device.
What is SSH?
SSH (Secure Shell) is an encrypted network protocol used to log into remote servers, run commands, and transfer files securely. It's the standard way developers connect to Linux servers, cloud instances, and Git hosting services like GitHub and GitLab.
What is an SSH Key?
An SSH key is a mathematically linked pair of files: a private key that stays on your device and a public key that you share with servers or services. Together they let you prove your identity cryptographically instead of typing a password on every connection.
Public vs. Private Keys
The public key can be freely shared — it's designed to be posted in GitHub settings, pasted into a server's authorized_keys file, or handed to a cloud provider. The private key must never be shared; it's the secret half that proves you hold the matching public key, and anyone who obtains it can authenticate as you everywhere that public key is trusted.
How SSH Authentication Works
When you connect, the server checks whether your public key is listed in its authorized_keys file, then challenges your client to prove you hold the matching private key — your SSH client signs a piece of data with the private key, and the server verifies that signature using the public key it already has. Your private key itself is never transmitted.
Ed25519 Explained
Ed25519 is a modern elliptic-curve signature algorithm designed for speed, small key size, and resistance to common implementation pitfalls. A single Ed25519 key offers strong, fixed security with no size decision to make, and is the recommended default for virtually all new SSH keys today.
RSA Explained
RSA is an older public-key algorithm based on the difficulty of factoring large numbers. It remains widely supported (useful for very old servers), but requires much larger keys than Ed25519 for equivalent security, and 1024-bit RSA keys are now considered insecure — use at least 3072 bits.
ECDSA Explained
ECDSA is another elliptic-curve algorithm, standardized on the NIST P-256/P-384/P-521 curves. It's faster and more compact than RSA, though Ed25519 is generally preferred today for its simpler, more implementation-resistant design.
Why DSA Isn't Offered
DSA has been disabled by default in OpenSSH since version 7.0 (2015) because it's limited to a fixed, now-inadequate 1024-bit key size. The Web Crypto API has never supported it either — rather than roll an unverified, insecure legacy algorithm ourselves, this tool simply doesn't offer it.
Key Fingerprints
A fingerprint is a short cryptographic hash of the public key — displayed as SHA256:... by modern ssh-keygen, or the older colon-separated MD5:... format some tools still show — used to quickly verify a key's identity without comparing the full key text.
Randomart
Randomart is OpenSSH's "drunken bishop" ASCII-art visualization of a key's fingerprint. It's not cryptographically meaningful on its own, but makes it easier for a human eye to notice when a fingerprint has changed at a glance.
Passphrases
A passphrase encrypts your private key file at rest, so anyone who steals the file still can't use it without also knowing the passphrase. This tool doesn't apply that encryption in-browser (see the note in the generator above) — add one locally afterward with ssh-keygen -p -f your_key.
SSH Config, authorized_keys & known_hosts
~/.ssh/config lets you define per-host shortcuts (hostname, user, and which key to use); ~/.ssh/authorized_keys on a server lists the public keys allowed to log in as that user; ~/.ssh/known_hosts caches the server's own public key so your client can detect if it changes unexpectedly (a sign of a possible attack).
# ~/.ssh/config example Host myserver HostName 203.0.113.10 User deploy IdentityFile ~/.ssh/id_ed25519 Port 22
Using Your New SSH Key
Once you've generated a key pair above, here's how to install the public key with common services and platforms.
Go to GitHub → Settings → SSH and GPG keys → New SSH key, paste your public key, then test with:
ssh -T git@github.com # Hi username! You've successfully authenticated...
Go to GitLab → Preferences → SSH Keys, paste your public key, then test with:
ssh -T git@gitlab.com
Add the public key via the EC2 console (Key Pairs) at launch, or append it manually to an existing instance, then connect:
chmod 600 id_ed25519 ssh -i id_ed25519 ec2-user@your-instance-ip
Copy your public key to the server's authorized_keys file (or use ssh-copy-id):
ssh-copy-id -i id_ed25519.pub user@server-ip # or manually: cat id_ed25519.pub | ssh user@server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
Windows 10/11 ship OpenSSH built in. From PowerShell:
ssh -i C:\Users\you\.ssh\id_ed25519 user@server-ip # Or place the key under %USERPROFILE%\.ssh\ and reference it in your SSH config
Store the private key as a GitHub Actions secret, then load it in your workflow:
- name: Set up SSH
run: |
mkdir -p ~/.ssh
echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519
ssh-keyscan your-server.com >> ~/.ssh/known_hosts
RSA vs. Ed25519 vs. ECDSA
| Aspect | Ed25519 | RSA | ECDSA |
|---|---|---|---|
| Key size | Fixed, 256-bit | 2048–4096-bit (your choice) | 256/384/521-bit (curve choice) |
| Speed | Fastest | Slowest, especially at 4096-bit | Fast |
| Modern default? | Yes — recommended | Legacy-compatibility only | Good, but Ed25519 usually preferred |
| Implementation footguns | Very few, by design | Weak sizes still selectable (1024-bit) | Some historical concerns over curve choice |
SSH Keys vs. Password Authentication
| SSH Key | Password | |
|---|---|---|
| Brute-force resistance | Effectively immune | Vulnerable if weak/reused |
| Phishing resistance | High — nothing typed to steal | Low — can be phished |
| Convenience | No typing after setup | Typed every login |
| Revocation | Remove one public key | Change password everywhere it's reused |
OpenSSH Format vs. PuTTY (.ppk) Format
| OpenSSH | PuTTY (.ppk) | |
|---|---|---|
| Used by | Linux, macOS, WSL, modern Windows OpenSSH | PuTTY, WinSCP (legacy Windows tools) |
| This tool's output | Native — directly usable | Not generated; convert with PuTTYgen if needed |
| Format | openssh-key-v1 / PKCS8 PEM | Proprietary .ppk container |
Frequently Asked Questions
What is an SSH key?
An SSH key is a pair of cryptographic keys — a private key you keep secret and a public key you share — used to log in to servers and services like GitHub without typing a password, and more securely than a password.
Is this SSH key generator secure?
Yes. It uses your browser's native Web Crypto API to generate the key pair — the same cryptographic engine built into every modern browser — rather than a custom or unverified implementation. Key generation and formatting happen entirely on your device.
Does my private key ever leave my browser?
No. The private key is generated, formatted, and displayed entirely in your browser's memory. Nothing is sent to ToolAdda's servers or any third party at any point.
Which algorithm should I choose?
Ed25519 is recommended for most modern uses — it's fast, produces short keys, and is supported by GitHub, GitLab, and virtually all current servers. Choose RSA only if you need to support very old systems that predate Ed25519 support.
Is Ed25519 better than RSA?
For most purposes, yes — Ed25519 offers equivalent or stronger security than RSA-2048/3072 with much shorter keys and faster signing, and it has no configurable key-size footgun (unlike RSA, where 1024-bit keys are insecure). RSA remains useful only for compatibility with legacy systems.
What key size is recommended?
For RSA, use at least 3072 bits (4096 for long-term keys); 2048 is the practical legacy minimum. Ed25519 has a single fixed, modern security level and needs no size decision.
Can I use these keys with GitHub?
Yes. Copy the generated public key into GitHub under Settings → SSH and GPG keys → New SSH key, and keep the private key on your device for git to use when connecting over SSH.
Can I use them with AWS, GCP, or Azure?
Yes. Add the public key to your cloud provider's instance metadata, key pair settings, or an authorized_keys file on the server, then connect using the matching private key with ssh -i.
Can I regenerate keys?
Yes. Click Regenerate to create a brand-new key pair at any time — every generation uses fresh cryptographic randomness, so no two key pairs are ever the same.
Can I protect my key with a passphrase?
This tool doesn't add passphrase encryption to the private key in-browser, to avoid shipping an unverified, home-grown implementation of OpenSSH's passphrase key-derivation function. After downloading your private key, run ssh-keygen -p -f your_key locally to add a passphrase using OpenSSH's own trusted tooling.
Is this tool free?
Yes. It's completely free, has no usage limits, and requires no account or sign-up.
Does it work offline?
Once the page is loaded, key generation runs entirely through your browser's built-in Web Crypto API with no network calls, so it keeps working even if your connection drops.
Can I download a PKCS8 PEM version?
Yes. Alongside the OpenSSH private key format, this tool also exports a standard PKCS8 PEM private key, which many non-SSH tools and libraries (TLS, code-signing, some cloud APIs) expect instead.
What is a fingerprint?
A fingerprint is a short cryptographic hash of the public key, used to visually or programmatically confirm you're connecting to the right server or that a public key wasn't tampered with, without comparing the entire key text.
How do I install my public key on a server?
Append the public key line to ~/.ssh/authorized_keys on the target server (or use ssh-copy-id user@host, which does this for you), ensuring the file has 600 permissions and the .ssh directory has 700.
Where should I store my private key?
Keep it only on your local device, typically in ~/.ssh/, with file permissions restricted to your user (chmod 600). Never email it, commit it to a repository, or paste it into a chat tool.
Can I rotate SSH keys?
Yes — generate a new key pair, add the new public key everywhere the old one was authorized, confirm the new key works, then remove the old public key from every server and service.
Why shouldn't I share my private key?
Anyone with your private key can authenticate as you on every server and service where your matching public key is trusted — it is the equivalent of your password, not something safe to share, back up in plain chat, or store in shared drives.
Does it support Windows?
Yes. The generated OpenSSH-format keys work directly with Windows 10/11's built-in OpenSSH client, PowerShell, and WSL.
Does it support Linux and macOS?
Yes. The generated keys are in the same OpenSSH format produced by ssh-keygen on Linux and macOS, and work identically with both operating systems' built-in SSH clients.
Can I use it in CI/CD pipelines?
Yes. Generate a dedicated deploy key, add its public half to the target service (GitHub deploy keys, a server's authorized_keys, etc.), and store the private key as an encrypted secret in your CI/CD platform (GitHub Actions, GitLab CI, Jenkins credentials).
Does it support Kubernetes?
SSH keys generated here work anywhere OpenSSH keys are used, including SSH access to Kubernetes nodes or git-based deploy keys referenced by Kubernetes Secrets for private repository access.
How is randomness generated?
Key material is generated using the Web Crypto API's cryptographically secure random number generator (backed by your operating system's CSPRNG), the same source browsers use for TLS and other security-critical operations.
Is browser cryptography safe for this?
Yes — the Web Crypto API is a W3C standard implemented natively by the browser vendor (not by this website), and is the same engine used for WebAuthn, TLS-adjacent operations, and other browser security features.
Why isn't DSA offered?
DSA has been disabled by default in OpenSSH since version 7.0 (2015) due to its weak fixed 1024-bit key size, and the Web Crypto API has never supported it — so it isn't offered here rather than shipping an unverified, insecure legacy algorithm.
Related Developer & Security Tools
Create strong, random passwords with custom rules.
💪 Password Strength CheckerCheck how resistant a password is to cracking.
🪪 JWT DebuggerDecode and inspect JSON Web Tokens for API debugging.
✍️ JWT EncoderCreate and sign JWTs with HS256, RS256, or ES256.
🆔 UUID GeneratorGenerate UUID v1, v4, v7, nil, and empty GUIDs.
🔐 Base64 Encoder/DecoderEncode or decode Base64 strings and files instantly.
🛡️ SSL CheckerInspect a domain's TLS certificate chain and expiry.
🌐 DNS LookupInspect DNS records such as A, AAAA, MX, TXT, CNAME.
🧮 IP Subnet CalculatorCalculate network address, broadcast, and CIDR ranges.
Ready to Generate Your SSH Key?
Create a secure Ed25519, RSA, or ECDSA key pair in seconds — generated locally in your browser, free, private, and ready for GitHub, your servers, or the cloud.
🔐 Generate SSH Keys Now