How do I generate an SSH key online?

Choose Ed25519, enter a comment such as your email, press Generate, then download the private key (id_ed25519) and the public key (id_ed25519.pub). Put both in ~/.ssh and add the .pub line to the server or your Git host.

Is Ed25519 better than RSA?

For SSH, yes: Ed25519 keys are much shorter, faster to use and offer security comparable to RSA-3072. Choose RSA only for systems that do not support Ed25519.

Why is Ed25519 unavailable in my browser?

Ed25519 in the Web Crypto API arrived in Firefox 129, Safari 17 and Chrome 137. In an older browser, update it or choose ECDSA or RSA instead.

Can I add a passphrase to the private key?

The key is generated without one. Add a passphrase on your own machine with ssh-keygen -p -f ~/.ssh/id_ed25519, which encrypts the file in place.

How do I convert the key to PuTTY's .ppk format?

Open PuTTYgen, choose Load, select the OpenSSH private key you downloaded and save it as a private key. PuTTYgen reads the OpenSSH format directly.

Which file goes on the server?

Only the public key, the single line from the .pub file, appended to ~/.ssh/authorized_keys. The private key stays on your computer and should never be shared.

Why does SSH say my private key permissions are too open?

SSH refuses private keys other users can read. Run chmod 600 on the private key file and chmod 700 on the ~/.ssh directory.

Are the keys sent to a server?

No. They are generated by your browser's Web Crypto API on this page and exist only in memory until you download or copy them.

SSH Key Generator: Ed25519, RSA & ECDSA Keys

Generate an SSH or RSA key pair without installing anything

This key generator creates a new Ed25519, ECDSA (P-256, P-384, P-521) or RSA (2048, 3072, 4096-bit) key pair with your browser's Web Crypto API and writes it out the ways you need: an OpenSSH private key and an <code>authorized_keys</code> line, exactly as <code>ssh-keygen</code> would produce them; PKCS#8 and SPKI PEM files for OpenSSL, TLS and JWT libraries; a public JWK; and the <code>SHA256:</code> fingerprint. The keys are generated on your device and the private key never leaves this page.

How to generate an SSH key pair

1Choose the key type: Ed25519 is the modern default for SSH; pick RSA for older servers and for PEM or JWT signing keys.
2Optionally enter a comment, usually user@host, so you can recognise the key later in authorized_keys.
3Press Generate. Download the private key as id_ed25519 (or id_rsa, id_ecdsa) and the public key as the same name with .pub.
4Move both into ~/.ssh/, run chmod 600 ~/.ssh/id_ed25519, and add the public key line to the server's ~/.ssh/authorized_keys or your Git host's SSH key settings.

Which key type should I choose?

Ed25519: Small (a 68-character public key), fast and resistant to implementation mistakes. Supported by OpenSSH 6.5 and later, GitHub, GitLab and every current server. The best choice for SSH today.
ECDSA (P-256, P-384, P-521): NIST curves, needed where compliance rules call for them or where Ed25519 is not accepted, such as some hardware tokens and cloud key services.
RSA: The most compatible choice, including very old SSH servers and many TLS and JWT (RS256) libraries. Use at least 3072 bits for keys meant to last beyond 2030; 2048 is the minimum still considered acceptable.

The formats explained

OpenSSH private key: <code>-----BEGIN OPENSSH PRIVATE KEY-----</code>, the format <code>ssh-keygen</code> writes by default. Generated here unencrypted; add a passphrase afterwards with <code>ssh-keygen -p -f id_ed25519</code>.
OpenSSH public key: One line, <code>ssh-ed25519 AAAA… comment</code>, for <code>authorized_keys</code>, GitHub, GitLab and cloud consoles.
PKCS#8 private key (PEM): <code>-----BEGIN PRIVATE KEY-----</code>, the standard container OpenSSL, Java, Node.js, Go and most JWT libraries read for any key type.
SPKI public key (PEM): <code>-----BEGIN PUBLIC KEY-----</code>, the X.509 SubjectPublicKeyInfo form used to verify signatures and in JWT verification settings.
JWK: The public key as JSON (RFC 7517), with a <code>kid</code> thumbprint, ready to publish in a JWKS endpoint.

Fingerprints

The fingerprint is a SHA-256 hash of the public key in SSH wire format, Base64-encoded without padding: SHA256:…. It is what ssh-keygen -lf id_ed25519.pub prints, what GitHub lists next to each key and what SSH shows when it asks you to trust a new host. Comparing fingerprints is how you check that two copies of a public key are the same key.

Is it safe to generate keys in a browser?

The keys come from crypto.subtle.generateKey, the browser's built-in cryptography, which draws on the operating system's secure random number generator — the same source ssh-keygen uses. Nothing is sent over the network: you can load this page, disconnect, and generate keys offline.

For keys that protect production systems, the safest place to generate them is still the machine that will use them, with ssh-keygen -t ed25519, or a hardware key. This tool is ideal for test environments, CI deploy keys, JWT signing keys and machines without OpenSSH. To inspect a certificate built on such a key, use the certificate decoder.

Frequently asked questions

How do I generate an SSH key online?: Choose Ed25519, enter a comment such as your email, press Generate, then download the private key (id_ed25519) and the public key (id_ed25519.pub). Put both in ~/.ssh and add the .pub line to the server or your Git host.
Is Ed25519 better than RSA?: For SSH, yes: Ed25519 keys are much shorter, faster to use and offer security comparable to RSA-3072. Choose RSA only for systems that do not support Ed25519.
Why is Ed25519 unavailable in my browser?: Ed25519 in the Web Crypto API arrived in Firefox 129, Safari 17 and Chrome 137. In an older browser, update it or choose ECDSA or RSA instead.
Can I add a passphrase to the private key?: The key is generated without one. Add a passphrase on your own machine with ssh-keygen -p -f ~/.ssh/id_ed25519, which encrypts the file in place.
How do I convert the key to PuTTY's .ppk format?: Open PuTTYgen, choose Load, select the OpenSSH private key you downloaded and save it as a private key. PuTTYgen reads the OpenSSH format directly.
Which file goes on the server?: Only the public key, the single line from the .pub file, appended to ~/.ssh/authorized_keys. The private key stays on your computer and should never be shared.
Why does SSH say my private key permissions are too open?: SSH refuses private keys other users can read. Run chmod 600 on the private key file and chmod 700 on the ~/.ssh directory.
Are the keys sent to a server?: No. They are generated by your browser's Web Crypto API on this page and exist only in memory until you download or copy them.

RSA & SSH Key Pair Generator