SSH Key Generator
Generate an Ed25519, ECDSA or RSA SSH key pair in the standard OpenSSH format — created entirely in your browser with the Web Crypto API. The private key never leaves your device, which is exactly why you should generate keys yourself rather than on a server. Prefer to run it locally? The ssh-keygen command builder below writes the exact command for you.
New to this? Read the SSH key generator guide →
Keys are generated entirely in your browser with the Web Crypto API and encoded to the OpenSSH format locally. Nothing is uploaded — the private key never leaves this page, which is the whole point of generating it yourself rather than on someone else's server.
Or run ssh-keygen yourself
Generating on your own machine is the gold standard. This builds the command from the options above — change the key type or comment and it updates.
ssh-keygen -t ed25519
-a 100 raises the KDF work factor, making a stolen passphrase-protected key slower to brute-force. -sk requires OpenSSH 8.2+ and a FIDO2 security key, and keeps the private half on the hardware.
SSH key types compared
| Type | Security level | Public key size | Verdict |
|---|---|---|---|
| ed25519 | ~128-bit | 68 chars | Use this. Fast, small, no parameter choices to get wrong. |
| ecdsa (P-256) | ~128-bit | ~180 chars | Fine, but no advantage over Ed25519 and needs a good RNG at signing time. |
| rsa 3072 | ~128-bit | ~570 chars | The ssh-keygen default. Choose it only for old servers. |
| rsa 4096 | ~150-bit | ~740 chars | Slower to generate and verify; the extra margin rarely matters. |
| dsa | broken in practice | — | Never. Capped at 1024 bits and removed from OpenSSH 10. |
Full reasoning, including what quantum computing does and does not change: which SSH key type to use.
How to use the SSH key generator
- Pick a key type — Ed25519 is the modern default; ECDSA and RSA are there for systems that still require them. Add a comment (usually your email) to label the key.
- Press Generate. Save the private key to ~/.ssh/id_ed25519 and add a passphrase, and add the public key to your server's authorized_keys or your Git host (GitHub, GitLab, etc.).
- Set permissions with chmod 600 ~/.ssh/id_ed25519, then test with ssh -T git@github.com.
Using the key with Git and SFTP
Git over SSH and SFTP both authenticate the same way, so one key covers both. Add the public key to your Git host (GitHub: Settings → SSH and GPG keys) and test with ssh -T git@github.com. For a server, ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host appends it to the remote authorized_keys; after that sftp user@host uses the key with no password prompt. Juggling several keys is a job for ~/.ssh/config — one Host block per destination with its own IdentityFile.
Why generate keys locally
A private key is a credential: anyone who has it can log in as you. Generating one on a remote website means trusting that site never to keep a copy — a bad idea by design. This tool runs the key generation in your own browser with the built-in Web Crypto API, so the private key is created on your machine and never transmitted. You can verify that by turning off your network after the page loads: generation still works.
Where you'd use this
Setting up access to a server or Git host, especially when you want the key created on your own machine rather than handed to you by a service.
For example: A new laptop needs access to GitHub and three production servers. One Ed25519 key generated locally, the public half pasted into GitHub and appended to each server's authorized_keys, and passwords are out of the loop entirely.
Frequently asked questions
Is it safe to generate an SSH key in a browser?
With this tool, yes. The key pair is generated locally with the Web Crypto API and the private key is never uploaded — you can even disconnect from the network after the page loads and it still works. Generating a key on a remote server, by contrast, means trusting that server with your private key.
Should I choose Ed25519 or RSA?
Ed25519 for anything modern — it is smaller, faster and secure, and is supported by all current systems including GitHub and GitLab. Choose RSA (3072 or 4096) only for legacy hosts that lack Ed25519 support. ECDSA works too but offers no advantage over Ed25519.
What does ssh-keygen -t ed25519 do?
It creates an Ed25519 key pair: a private key saved to ~/.ssh/id_ed25519 and a public key in ~/.ssh/id_ed25519.pub. The -t flag chooses the key type. On OpenSSH 9.5 and later Ed25519 is already the default, so plain ssh-keygen does the same thing; add -C "you@example.com" to label the key.
Can I use one key for both Git and SFTP?
Yes. SFTP runs inside an SSH session, so the same key authenticates both. Add the public key to your Git host and to authorized_keys on the server, and both git and sftp will use it.
Are SSH keys quantum-resistant?
Not today — Shor's algorithm would break Ed25519 and RSA alike. Modern OpenSSH already protects session confidentiality with post-quantum hybrid key exchange, and because user keys are signatures rather than encryption, recorded sessions cannot be used against them later. Rotating to a post-quantum key type when OpenSSH offers one will take minutes.
How do I install the key?
Save the private key to ~/.ssh/id_ed25519 and run chmod 600 on it, then add the public key to authorized_keys on the server (or use ssh-copy-id) or paste it into the SSH settings of your Git host. Only ever share the .pub file.
Why is the private key not passphrase-protected?
It is generated unencrypted so it works in any browser. Add a passphrase immediately after saving it with ssh-keygen -p -f ~/.ssh/id_ed25519, which encrypts the on-disk key so a stolen device does not expose your access.