SSH Keygen Online for Ed25519 and RSA 4096 Keys

What this SSH key generator does

It creates an SSH key pair with your browser's Web Crypto API and encodes it in the same formats ssh-keygen writes. The public key comes out as a single authorized_keys line — ssh-ed25519 AAAA… comment or ssh-rsa AAAA… comment — ready to paste into GitHub, GitLab, a cloud console or ~/.ssh/authorized_keys on a server. The private key is offered in OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----), which current OpenSSH, Git and most clients read, and as PKCS#8 PEM for libraries such as Node's crypto, Python's cryptography or Go's x/crypto. The SHA256 fingerprint is shown in exactly the form ssh-keygen -l prints, so you can confirm that the key a server reports is the one you made.

The key material is generated and encoded locally by JavaScript in this page; it is never sent to TechLogHub or any other server, and the page has no share link because the output contains a secret.

Ed25519 or RSA, and what the formats contain

Ed25519 is the right default for new keys: short (the public key is a 68-character base64 string), fast, and supported by every OpenSSH release since 6.5 (2014), GitHub, GitLab and the major clouds. Choose RSA only for older systems that reject Ed25519; use 4096 bits if you do, or 3072 as the current minimum many guidelines recommend. RSA keys are generated with RSASSA-PKCS1-v1_5 and the standard public exponent 65537, and OpenSSH negotiates the rsa-sha2-256/512 signature algorithms itself, so the same key works for modern servers.

Ed25519 key generation needs a browser whose Web Crypto supports it — Chrome and Edge 113+, Firefox 129+ and Safari 17+. On older browsers the Ed25519 option is disabled with a note, and RSA still works.

Under the hood the public key is the SSH wire format from RFC 4253: a length-prefixed algorithm name followed by the key, which for RSA is the exponent and modulus as mpints. The private key uses OpenSSH's openssh-key-v1 container with cipher "none", a pair of matching check integers, the key fields and your comment, padded to the block size. For Ed25519 the 64-byte private field is the 32-byte seed followed by the public key, exactly as ssh-keygen stores it.

Honest caveats: when to use ssh-keygen instead

Generating keys in a browser is convenient on a borrowed machine, a Chromebook, or when you need a throwaway deploy key, but for keys guarding production servers the better practice is to generate them on the machine that will use them with ssh-keygen -t ed25519, so the private key never exists anywhere else — not in a browser tab, a downloads folder or a clipboard manager. Browser extensions with access to the page could also read what is displayed. Our guide to generating SSH keys walks through the command-line route on macOS, Linux and Windows.

The private key produced here is not encrypted with a passphrase. After saving it to ~/.ssh/id_ed25519, run chmod 600 on it and add a passphrase with ssh-keygen -p -f ~/.ssh/id_ed25519. PuTTY users can import the OpenSSH private key into PuTTYgen and save it as .ppk.