SSH Key Generator
Understand SSH Key Generator
Generates an RSA (2048 or 4096-bit) or Ed25519 key pair in your browser and gives you the public key in OpenSSH format as well as PEM.
How it works
crypto.subtle.generateKey builds the pair from the platform CSPRNG, then exports the private key as PKCS#8 and the public key as SPKI, each base64-wrapped between PEM header lines. RSA security rests on the cost of factoring the modulus, which is why the key needs 2048 or 4096 bits; Ed25519 reaches comparable strength on a 256-bit curve with a 32-byte public key and much faster signing. The public key is also emitted in OpenSSH wire format — a length-prefixed blob of the algorithm name and key fields, base64-encoded on one line — which is what authorized_keys and the GitHub key box expect. Where a browser lacks Ed25519 in WebCrypto the tool falls back to ECDSA on P-256 and says so in its output rather than mislabelling the result.
When to use it
- Producing a throwaway key pair for a lab, a container image, or a test fixture.
- Getting a PEM public key to hand to a service that verifies signatures, such as an RS256 JWT consumer.
- Inspecting what PKCS#8 and SPKI actually contain while learning key formats.
- Generating a key on a machine where you cannot install or run OpenSSH.
- Comparing RSA-2048, RSA-4096, and Ed25519 output sizes side by side.
Watch out for
- Two formats are shown and they are not interchangeable. The OpenSSH line beginning ssh-rsa or ssh-ed25519 goes in authorized_keys and the GitHub key box; the PEM block is what libraries verifying signatures usually want. Pasting the wrong one produces an unhelpful error at the far end.
- The private key here has no passphrase. Running ssh-keygen locally offers to encrypt the key at rest; this exports it in the clear, so anything that reads the page or the clipboard walks away with a usable key.
- An "Ed25519" request may return ECDSA P-256, on a browser whose WebCrypto lacks Ed25519. The tool reports the algorithm it actually generated rather than the one you asked for, so read that line before relying on the key type.
- RSA-2048 is still acceptable, but 4096 is the conservative choice for a long-lived key, and Ed25519 is smaller and faster than either. OpenSSH has supported Ed25519 since version 6.5 in 2014, so compatibility is rarely the deciding factor now.
Not the right tool for: Keys that protect real infrastructure. Generate those locally with ssh-keygen -t ed25519 -C "you@example.com", where the private key is written straight into ~/.ssh under a passphrase and never exists inside a browser tab.
Frequently Asked Questions
How to generate SSH key?
Choose Ed25519 (recommended) or RSA 2048/4096, optionally add a comment such as your email, then click Generate. Keys are created in your browser with the WebCrypto API and never sent anywhere. You get an OpenSSH public key for servers plus PEM copies of both keys.
How to generate SSH key for GitHub?
Generate an Ed25519 key pair, then copy the OpenSSH public key — the line starting ssh-ed25519 — and on GitHub open Settings, SSH and GPG keys, New SSH key, and paste it there. Save the PEM private key as ~/.ssh/id_ed25519 with chmod 600, then test using ssh -T git@github.com
How to generate SSH key on Windows?
Use this browser tool (no software install needed) or open PowerShell and run: ssh-keygen -t ed25519 -C "your_email". Keys are saved to C:\Users\YourName\.ssh\. The public key (id_ed25519.pub) is what you add to remote servers and GitHub.
How to Use SSH Key Generator
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.