SSH key generator

An Ed25519 or RSA key pair in OpenSSH format, ready for ~/.ssh. Everything runs in your browser: the private key is never sent to us.

How to use your new key

Save the private key as ~/.ssh/id_ed25519 (or ~/.ssh/id_rsa for RSA). On Linux and macOS, lock it down with chmod 600 ~/.ssh/id_ed25519, or SSH refuses to use it.
Add a passphrase straight away: ssh-keygen -p -f ~/.ssh/id_ed25519. Then a stolen key file is useless on its own.
Put the public key on the server, as one line in ~/.ssh/authorized_keys: echo "PASTE PUBLIC KEY" >> ~/.ssh/authorized_keys
Log in: ssh -i ~/.ssh/id_ed25519 user@server. If it works, you can turn off password logins on the server.

On Windows 10 and 11 the built-in OpenSSH uses the same files, in C:\Users\you\.ssh\. Step-by-step help: log in with SSH keys.

Good to know

Keys are made with your browser's built-in cryptography (Web Crypto). Ed25519 needs a 2025 or newer browser (Chrome 137, Firefox 129, Safari 17); RSA works everywhere.
The private key is shown without a passphrase, because browsers cannot write OpenSSH's encrypted format. Step 2 above adds one in a second.
Prefer to make keys on your own computer? Run ssh-keygen -t ed25519 -C "me@laptop". It does the same thing.

SSH key questions

Is it safe to generate an SSH key online?

On this page, yes: the key is made on your device by the browser and the page sends nothing anywhere. You can disconnect from the internet after the page loads and it still works. Still, for keys that guard something important, running ssh-keygen on your own computer is the gold standard.

Ed25519 or RSA?

Ed25519 for anything made in the last ten years: the keys are short, fast and safe. Use RSA 4096 only for old servers or devices that do not accept Ed25519 (OpenSSH before 6.5, from 2014).

What is the fingerprint for?

It is a short summary of the public key. Servers and services like GitHub show it, so you can check which key is which. It is the same value ssh-keygen -lf prints.

Can I use this key for GitHub or GitLab?

Yes. Paste the public key into your account's SSH keys settings. Never paste the private key anywhere.

More free tools: all tools, WireGuard config generator, DNS lookup, cron expression generator.

Key type	Ed25519 (recommended: short, fast, modern) RSA 4096 (for old systems that do not support Ed25519)
Comment	A label to recognise the key later, usually you@computer.