SSH Key Generator – Ed25519 & RSA Keys Online, In-Browser

Generate an SSH key pair without leaving your browser

This SSH key generator creates a fresh key pair on your own device: pick Ed25519 (small, fast and the modern default) or RSA 2048/4096, add a comment, and you get the one-line OpenSSH public key for authorized_keys, GitHub, GitLab, Bitbucket or a cloud console, the private key in the OpenSSH file format that ssh expects, and the SHA256 fingerprint to confirm the key later.

The keys come from the Web Crypto API built into Chrome, Edge, Firefox and Safari — the same cryptographically secure random source and algorithms a native tool uses. If a browser does not yet expose Ed25519 through Web Crypto, the page falls back to TweetNaCl, a small audited JavaScript implementation released into the public domain (Unlicense), and says so under “Generated with”.

Nothing is uploaded, logged or stored. Because the private key is written without a passphrase, the page tells you how to add one with ssh-keygen -p before you rely on it.

How to use the SSH Key Generator

Choose a Key type: Ed25519 unless a legacy system requires RSA, in which case use RSA 4096 for new keys.
Edit the Comment (usually your email or user@machine). It is stored in both files and helps you recognise the key later.
Press Generate key pair. A key is already generated when the page opens; every click makes a new one.
Copy the public key into ~/.ssh/authorized_keys on the server or paste it into the SSH keys page of GitHub, GitLab, DigitalOcean, AWS or Azure.
Download the private key, move it to ~/.ssh/id_ed25519 (or id_rsa), run chmod 600 on it and add a passphrase with ssh-keygen -p -f ~/.ssh/id_ed25519.
Verify with ssh-keygen -lf ~/.ssh/id_ed25519.pub — the printed SHA256 fingerprint must match the one shown here.

SSH Key Generator features

Ed25519 and RSA

Ed25519 keys are 256-bit elliptic-curve keys (RFC 8709); RSA keys use a 65537 exponent at 2048 or 4096 bits, matching what ssh-keygen -t rsa -b 4096 produces.

Real OpenSSH private key format

The private key is encoded in the openssh-key-v1 container (cipher “none”, KDF “none”, check integers, comment and block padding), exactly as OpenSSH 7.8+ writes it, so it works with ssh, ssh-agent, Git and VS Code without conversion.

PEM alternatives

Switch to PKCS#8 (BEGIN PRIVATE KEY) for libraries and cloud SDKs, or PKCS#1 (BEGIN RSA PRIVATE KEY) for older tools that expect the classic RSA format.

SHA256 fingerprint

The fingerprint is the SHA-256 hash of the public key blob in the same SHA256:… notation that ssh-keygen -l and GitHub display.

Install instructions

A ready-to-run snippet shows where to put the files, how to set permissions, add a passphrase, check the fingerprint and copy the key to a server with ssh-copy-id.

Ed25519 or RSA — which SSH key should you generate?

Ed25519 is the right choice for almost everyone in 2026: the keys are tiny (a 68-character public key), signing is fast, there are no parameter choices to get wrong, and it has been supported by OpenSSH since version 6.5 (2014), by GitHub, GitLab, Bitbucket and every major cloud. RSA remains useful only where an old appliance, a legacy Git server or a hardware token supports nothing else.

	Ed25519	RSA 2048	RSA 4096
Security level	~128-bit	~112-bit	~140-bit
Public key length	68 chars	~380 chars	~730 chars
Generation time in a browser	instant	< 1 s	2–10 s
Supported since	OpenSSH 6.5	everywhere	everywhere
Typical file name	`id_ed25519`	`id_rsa`	`id_rsa`

Is generating SSH keys in a browser safe?

The random numbers come from crypto.getRandomValues and crypto.subtle.generateKey, which the browser backs with the operating system’s cryptographic random generator — the same source ssh-keygen uses. The page makes no network requests with the key material; you can confirm that in the browser’s Network panel or by generating a key while offline.

Two practical cautions remain. First, a key shown on screen can be seen by anyone looking at it or by a screen-recording extension, so generate keys on a machine you trust. Second, the private key is unencrypted until you add a passphrase; do that with ssh-keygen -p straight after saving it, and never paste a private key into chat, tickets or source control. For hashing or password needs, see the Hash Generator and Password Generator.

Where the public key goes

Linux/macOS server: append the line to ~/.ssh/authorized_keys (one key per line), or run ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host.
GitHub: Settings → SSH and GPG keys → New SSH key; test with ssh -T git@github.com.
GitLab / Bitbucket: Preferences → SSH keys. Both display the SHA256 fingerprint so you can compare it with the one shown here.
AWS EC2 / Azure / GCP: import the public key as a key pair or add it to the instance metadata; the private key stays on your computer.
Windows: keys live in C:\Users\you\.ssh\; OpenSSH for Windows and Git Bash read the same files and formats.

SSH Key Generator FAQ

Is this SSH key generator safe to use for real servers?

Yes, provided your computer is trustworthy. Keys are generated with the browser’s Web Crypto API and never transmitted. Add a passphrase to the private key afterwards and keep it out of shared folders and repositories.

Why is the private key unencrypted?

OpenSSH encrypts private keys with bcrypt_pbkdf, which is not part of Web Crypto. Rather than ship a weaker scheme, the page writes the key unencrypted and tells you to run ssh-keygen -p -f id_ed25519, which adds a passphrase in place.

Which format should I pick for the private key?

OpenSSH for anything you will use with ssh, Git or an agent. PKCS#8 for programming libraries (Python cryptography, Node, Java) and most cloud SDKs. PKCS#1 only for old tools that insist on BEGIN RSA PRIVATE KEY.

How do I generate an SSH key for GitHub?

Keep Ed25519, set the comment to your GitHub email, generate, copy the public key into GitHub → Settings → SSH and GPG keys, then save the private key as ~/.ssh/id_ed25519 with permission 600 and run ssh -T git@github.com.

What is the SHA256 fingerprint for?

It is a short hash of the public key. Servers and services show it so you can confirm you are dealing with the right key; ssh-keygen -lf id_ed25519.pub prints the same value.

Can I convert the key to PuTTY’s .ppk format?

Not here. Load the OpenSSH private key into PuTTYgen (Conversions → Import key) and save it as .ppk; recent PuTTY versions also accept OpenSSH keys directly.