Developer tool
SSH Key Generator
Free, no sign-up. Runs in your browser; nothing is uploaded.
Keys are generated in your browser with Web Crypto and never sent anywhere. Even so, treat a web page as a convenience: for production servers, prefer ssh-keygen on your own machine.
Key options
Shown at the end of the public key, usually an email or host name.
ssh-keygen -p -f ~/.ssh/id_ed25519 to protect it, and set permissions with chmod 600.Public key
Press Generate key pair.
Private key
Shown here after generating. Keep it secret.
How to use the ssh key generator
Create a key pair
- Pick the type. Ed25519 is the modern default; RSA 3072 and 4096 are for older systems.
- Add a comment, such as your email or the name of the machine. It only labels the key.
- Press Generate key pair. The public key, the private key and the fingerprint appear on the right.
- Copy or download each file.
Install the keys
Save the private key as ~/.ssh/id_ed25519 (or id_rsa) and lock it down:
chmod 600 ~/.ssh/id_ed25519
Append the public key line to ~/.ssh/authorized_keys on each server you want to reach, or paste it into the SSH settings of GitHub, GitLab or Bitbucket. Then connect with ssh user@host.
Add a passphrase
A passphrase encrypts the private key file, so a stolen laptop or backup does not hand over server access. Add one after saving the file:
ssh-keygen -p -f ~/.ssh/id_ed25519
About the formats
The Ed25519 private key uses the OpenSSH format that begins with BEGIN OPENSSH PRIVATE KEY. RSA keys are written as PKCS#8 PEM, which current OpenSSH reads directly. The public key is the single line OpenSSH expects, starting with ssh-ed25519 or ssh-rsa.
Security notes
Everything is generated locally by your browser's Web Crypto engine, and nothing is uploaded. Never share the private key, never paste it into chat or tickets, and rotate a key if you think it leaked. Use one key per device so you can revoke a single machine.
Frequently asked questions
Ed25519 or RSA?
Choose Ed25519 for new keys: it is short, fast and secure. Pick RSA 3072 or 4096 only if an older server or service does not accept Ed25519.
Is it safe to generate a key on a web page?
The key is created by your browser and never leaves it, and this page makes no network requests with it. Still, for high-value servers, create keys with ssh-keygen on a machine you control.
Why is the private key not encrypted?
Browsers cannot reproduce the exact OpenSSH passphrase format here. Run ssh-keygen -p -f on the saved file to add a passphrase in one step.
Where do I put the public key?
Append the whole line to ~/.ssh/authorized_keys on the server, or paste it into the SSH keys page of GitHub, GitLab or your host.
What is the fingerprint for?
It is a short ID of the public key in the same SHA256 form that ssh and ssh-keygen -l show. Use it to confirm that you installed the right key.