Generate an SSH Key Pair — Free ED25519/RSA OpenSSH Generator

Use the SSH Key Pair Generator to create a fresh SSH key pair right in your browser — pick an algorithm (ED25519 or RSA), optionally add a comment like your email address, then click Generate SSH Key Pair to get a matching public key and private key in standard OpenSSH format. Everything runs locally through your browser's Web Crypto API, so your private key is never transmitted anywhere.

Whether you're locking down a cloud server, pushing code to GitHub, or automating deployments in a CI/CD pipeline, this SSH key pair generator gives you cryptographically strong public and private keys in seconds — entirely in your browser, with your private key never uploaded or transmitted to any server. Understanding what your generated keys mean, how to deploy them correctly, and which algorithm best fits your environment is what turns a simple key into a genuinely secure access credential.

Generate SSH Keys Online — Browser-Based, Client-Side Protection with Our SSH Key Pair Generator

This online tool runs all enciphering operations directly in your browser using the Web Crypto API. Because key pair creation happens client-side, your private key is never sent to a server, never logged, and never stored — keys deleted from memory as soon as the page is closed or refreshed. The tool supports four key types and produces fully compatible output ready to paste into an authorized_keys file or upload to any remote host. Use it to generate SSH keys online without installing any software, making it ideal for any developer who needs quick, trustworthy key creation.

Your Public Key and Private Key Output

Once you click Generate, the tool displays two output blocks. The first is your private key in standard key format — keep this secret, store it in your ~/.ssh/ directory, and set file permissions to 600. The second is your public key, which you share freely: paste it into the authorized_keys file on any remote host, add it to your code-hosting account, or upload it during cloud instance creation. Copy buttons appear alongside each block for one-click access to the full text key. Below the keys you'll also see the visual hash — a randomart image that makes it easy to distinguish between key pairs at a glance, representing the key's hash visually.

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZWQy
NTUxOQAAACB...base64 continues...
-----END OPENSSH PRIVATE KEY-----
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...base64... user@hostname
The key's randomart image is:
+--[ED25519 256]--+
|   .   o.o  .+ ..|
|    ..o.S   o..  |
|   . %o=      .  |
|    @.B...     . |
|   o.=. o. . .   |
+----[SHA256]-----+

Choosing the Right Key Algorithm and Key Size

The algorithm dropdown lets you select from four options. ED25519 is the recommended default for all new keys: it uses elliptic curve enciphering at 256 bits, produces tiny output files, is faster than RSA, and is resistant to timing attacks. ECDSA (the ecdsa algorithm) supports key sizes of 256 bits, 384 bits, and 521 bits — always choose 521 for maximum protection. RSA remains the most universally supported; choose RSA 4096-bit for new RSA keys, or at a minimum RSA 2048-bit. The DSA option is included for legacy compatibility only — DSA is based on computing discrete logarithms and is no longer recommended for new deployments. The key size field (number of bits) is only active for RSA and ECDSA, since ED25519 has a fixed key length.

Specifying the File Name and Passphrase

The optional file name field works exactly like the -f option in the ssh-keygen command: it labels your downloaded key files so you can manage multiple keypairs without confusion. For example, entering id_ed25519_github produces id_ed25519_github (private) and id_ed25519_github.pub (the pub file). The key passphrase field adds an extra layer of passphrase encryption to your stored private credential — even if someone steals the file, they cannot use it without the passphrase. Enter a strong passphrase in the key passphrase field, repeat it in confirm passphrase, then click Save Private Key to download. If you prefer no passphrase for automated scripts or continuous-integration workflows, leave both fields empty. Much like a random password generator produces strong secrets you store safely, this tool produces strong key material you download and protect locally.

Privacy guarantee: All key pair creation runs entirely in your browser. Your keys are not uploaded and not transmitted anywhere — private key not uploaded to any server, ever. This tool has offline PWA support, meaning it works even without an internet connection after the first page load. The page rendered in your browser is the only place your keys ever exist.

What Are SSH Keys and How Does Public Key Authentication Work?

The SSH protocol (Secure Shell) uses public key cryptography to authenticate both hosts and users without transmitting a password over the network. This method — called public key authentication — is more robust than password-based login because the secret never leaves your machine. It enables automating logins, single sign-on, and scalable access verification across hundreds of machines in a DevOps or cloud environment.

How the Public Key and Private Key Relationship Works

Public private keys are generated together as a mathematically linked pair. Your public key can be shared with anyone — it acts like a padlock. Your private key is the only key that opens that padlock, and it never leaves your local machine. During the login process, the remote host challenges your client to prove possession of the private key by performing a digital signing operation on the key exchange data. The host verifies the signature using the stored public key. This process underpins digital access verification and public key infrastructure (PKI) at scale.

This is a form of asymmetric enciphering: the same key that encrypts (or signs) cannot decrypt (or verify) — only the mathematically paired key can do that. Compare this to a password-based system, where the secret must be transmitted and stored on the host, creating exposure at every point. With these key pairs, the proof is purely mathematical — cryptographically strong and verifiable without revealing the secret.

Choosing the Right Algorithm for Your Private Key Use Case

The key algorithm you choose has significant implications for compatibility and protection. Here is a practical comparison of all four supported algorithms:

  • ED25519 — based on the ed25519 algorithm (Edwards-curve Digital Signature Algorithm). Recommended for all general purpose systems. Offers excellent strength at just 256 bits, fast performance, and resistance to side-channel attacks. Your ed25519 public key and ed25519 private credential files are tiny. Default filenames: id_ed25519 / id_ed25519.pub. Not yet supported on some very old clients.
  • RSA — the rsa algorithm, based on the difficulty of factoring large numbers. Universal compatibility — all clients support RSA. Use RSA 4096-bit for new keys; RSA 2048-bit is the minimum acceptable. The rsa private credential defaults to id_rsa; the corresponding public key saves to id_rsa.pub. The SSH-2 RSA key format is what most platforms display when you add an RSA key. Note that RSA is aging — advances in computing make very long key bits increasingly important.
  • ECDSA — the ecdsa algorithm, a Digital Signature Algorithm using elliptic curves. Three valid key sizes: 256 bits, 384 bits, 521 bits. Choose 521 bits. Default key output: id_ecdsa / id_ecdsa.pub (also ssh_host_ecdsa_key for host keys).
  • DSA — the dsa algorithm, based on discrete logarithms at 1024 bits. Deprecated. Do not use for new keys. Included only for legacy interoperability. Default output: id_dsa / id_dsa.pub.

For embedded devices and IoT devices (Internet of Things), consider that low-end processors may not support the same operations efficiently. ED25519 is generally the best choice even on constrained hardware, outperforming RSA significantly in both speed and key size.

Why Entropy Matters for ED25519 and RSA Key Creation

Secure key creation depends on randomness — truly unpredictable random input drawn from the system. On general purpose systems and in modern browsers, this is gathered from mouse movements, disk activity, user interrupts, network traffic patterns, and hardware random number generators built into modern CPUs. The Web Crypto API used by this tool draws from the browser's cryptographically secure random source, so random-bit quality is not typically a concern for browser-based key creation.

However, on IoT or embedded systems creating keys without these random sources, weak randomness has caused thousands of devices to share the same host key — a catastrophic failure that enables man-in-the-middle attacks. If you're building a system image for embedded deployment, save a random seed file during installation, mix in hardware-sourced random bits, and only create host keys after the system has accumulated sufficient randomness. The ssh_host_rsa_key, ssh_host_ecdsa_key, ssh_host_ed25519_key, and ssh_host_dsa_key files in /etc/ssh/ must all be produced with strong random input.

How to Generate SSH Keys on Any Operating System

Beyond using this browser-based ssh key pair generator to generate keys, you can create them natively on any OS using the command line keygen program included with the standard secure-shell toolkit. Here are complete, ready-to-run examples for every platform.

macOS and Linux: Terminal Commands for SSH Key Creation

On macOS (Macintosh) and Unix-based systems, open your terminal utility. On macOS, find Terminal in the Utilities folder inside Applications, or launch it from the Dock via Finder. On Unix distributions, use your system's default terminal emulator.

Example 1 — Generate ED25519 key pair for repository access:

  1. Run the keygen utility with your email as the comment:
    ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519
  2. Enter a passphrase when prompted (recommended) or press Enter for no passphrase:
    Enter passphrase (empty for no passphrase): 
Enter same passphrase again:
  3. Confirm the output — the tool confirms both files and displays a hash summary:
    Your identification has been saved in /home/ylo/.ssh/id_ed25519.
Your public key has been saved in /home/ylo/.ssh/id_ed25519.pub.
The key fingerprint is:
SHA256:Up6KjbnEV4Hgfo75YM393QdQsK3Z0aTNBz0DoirrW+c [email protected]
The key's randomart image is:
+--[ED25519 256]--+
|   .   o.o  .+ ..|
|    ..o.S   o..  |
|   . %o=      .  |
|    @.B...     . |
+----[SHA256]-----+
  4. Copy the public key for pasting into your code-host Settings → SSH Keys:
    cat ~/.ssh/id_ed25519.pub

Example 2 — Create RSA 4096-bit key for cloud server login:

  1. Run the generate RSA command:
    ssh-keygen -t rsa -b 4096 -C "aws-ec2-login" -f ~/.ssh/id_rsa_aws
  2. Enter passphrase at the interactive prompt.
  3. Deploy the public key using the copy utility:
    ssh-copy-id -i ~/.ssh/id_rsa_aws.pub ec2-user@your-ec2-ip

The -b option sets the number of bits (e.g., 4096). The -t option selects the key type. The -C flag adds a key comment (your email or a label). Use the -f option (file name option) to set a custom path, avoiding overwriting your default credential files.

Windows: PowerShell, Command Prompt, and Key Generation via GUI

Modern operating systems on the Windows platform (10 1809+ and 11) ship with the secure-shell toolkit built in. Open PowerShell as a regular user and run the same keygen commands shown above via the command line — the syntax is identical. Your keys are saved to C:\Users\your_username\.ssh\ by default.

# PowerShell — produce ED25519 key pair
ssh-keygen -t ed25519 -C "[email protected]"

# PowerShell — produce RSA 4096 key pair
ssh-keygen -t rsa -b 4096 -C "server-access"

If you use PuTTY for terminal sessions on that platform, you'll need PuTTYgen to produce a PuTTY .ppk format credential. The PuTTY client requires the .ppk format — standard keys must be converted PEM or imported via PuTTYgen's Conversions → Import Key menu. From PuTTY 0.78+, PuTTYgen can directly import ED25519 keys and handle .ppk conversion. For the reverse — convert OpenSSH to .ppk — open PuTTYgen, load the credential, and click Save private key. The resulting putty .ppk format file works in both PuTTY and WinSCP for file-transfer sessions.

Note: For Tectia SSH users on that platform, the ssh-keygen-g3 utility creates keys in Tectia's format. The options differ slightly from the standard keygen arguments — refer to the Tectia documentation for the specific flags available in that environment.

Adding Your Key to the Authentication Agent

The ssh-agent is a background program that holds your decrypted passphrase in memory so you only enter it once per session. It also supports agent forwarding, letting remote commands authenticate back through your local agent. Here is how to start the agent and load your new key:

Example 3 — Create and add a key to the agent on macOS/Unix:

  1. Start the agent in the background:
    eval "$(ssh-agent -s)"
  2. Add your key with ssh-add:
    ssh-add ~/.ssh/id_ed25519
  3. Confirm it is loaded — a hash summary appears in the list output:
    ssh-add -l
# Output: 256 SHA256:Up6KjbnEV4Hgfo75YM393... [email protected] (ED25519)

On macOS, add UseKeychain yes and AddKeysToAgent yes to your config file (~/.ssh/config) so the key is automatically reloaded after a reboot. These config helpers eliminate the need to run ssh-add manually each session.

Host keys are a separate set of key pairs generated for the host itself, not for individual users. They live in /etc/ssh/ and include ssh_host_rsa_key, ssh_host_ecdsa_key, ssh_host_ed25519_key, and ssh_host_dsa_key. These enable host verification — when your client connects to a remote machine for the first time, the tool records the host's key in the known_hosts file to detect any future man-in-the-middle attack. Do not share or rotate these lightly; always use a structured key-administration tool when changing host keys at scale.

For large enterprise deployments, X.509 certificates (supported by Tectia but not by the standard toolkit natively) and signed certificates from internal certificate authorities provide more scalable host checking. Both enable strict host verification without training users to accept changed hashes blindly. OpenSSL can be used to generate X.509 certificate signing requests for this purpose, and tools like the PrivX Key Manager can automate setup across an enterprise.

Deploying and Managing Your SSH Key Pair Online

Generating an SSH key pair is only the first step — deploying your public key to the right location and following strong key-administration practices determines whether your access tokens stay protected over time. Here's how to deploy your keys across the most common platforms, and how to keep your practices aligned with cybersecurity regulatory frameworks like NIST IR 7966.

Copying Your Public Key to a Remote Host Using authorized_keys

The standard method for host access is to append your public key to the ~/.ssh/authorized_keys file on the remote machine. The fastest approach uses the copy-id utility:

ssh-copy-id -i ~/.ssh/id_ed25519.pub your_username@remote-server-ip

If the copy utility is unavailable (common on older systems or during initial setup), manually append the public key content:

cat ~/.ssh/id_ed25519.pub | ssh your_username@remote-server-ip \
  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

This manual method works identically for secure file-transfer access — the host reads from the same authorized_keys file regardless of whether the session is interactive or file-transfer based. Once the key is in place, password-based login can be disabled entirely in /etc/ssh/sshd_config by setting PasswordAuthentication no, leaving only key-based access verification.

Adding SSH Keys to Code Hosts, Cloud Providers, and Deployment Platforms

Every major platform accepts compatible public keys. Here's the workflow for each:

  1. GitHub SSH key: Go to Settings → SSH and GPG keys → New SSH key. Paste your ed25519 public key (or RSA public key) into the Key field. The title can be your machine name. This enables both git operations and key-based user verification. Use your account email as the -C comment when generating to make the key identifiable. This is the standard procedure for adding a github ssh key.
  2. Code-hosting platform (e.g., GitLab): Go to Preferences → SSH Keys → Add new key. Paste the public key block. Set an expiry date if your regulatory requirements mandate time-limited access tokens. This grants remote access to all repositories your account can reach.
  3. Cloud compute (e.g., EC2): In the cloud console, navigate to Key Pairs → Import Key Pair and paste your public key, or use the CLI: aws ec2 import-key-pair --key-name "my-key" --public-key-material fileb://~/.ssh/id_rsa.pub. For existing instances, append the key to ~/.ssh/authorized_keys via the copy-id utility. Similar cloud portals follow the same pattern: add the public key during VM creation or append it manually for existing machines.
  4. Bitbucket: Go to Personal Settings → SSH Keys → Add key. The process is identical to the GitHub workflow — paste your public key and label it. That platform also supports ED25519 and RSA key pairs for both git and secure file-transfer access.

For automated workflows in continuous-integration pipelines, store the private key as an encrypted secret variable in your CI platform (Actions, CI runners, Jenkins). A job can then use it to verify access against deployment machines without any human interaction — enabling full automation across your environment. These are typical access patterns in modern DevOps.

Key management best practices: Treat access key pairs as permanent tokens — they remain valid even after a user account is deactivated unless explicitly removed. Implement a proper setup and termination process: add keys when accounts are created, rotate them on a schedule, and audit the authorized_keys file on every machine regularly. Organizations under regulatory mandates (PCI-DSS, SOC 2, ISO 27001) must document and manage key pair requirements. Tools like PrivX Key Manager automate this at enterprise scale, enforcing access control, authorization, and network protection policies across all managed hosts. Leaked or stolen private keys are a leading cause of breaches — a single improperly configured key can grant unlimited access to your entire production environment.

Command Reference: ssh-keygen Options and Key Actions

The ssh-keygen command-line utility is the native keygen tool included with every standard secure-shell installation. Understanding its flags gives you precise control over key parameters, bit length, output format, and passphrase management — all the same key actions available in this online ssh key pair generator for developers who prefer the command line. Here is a comprehensive reference of the most useful options and arguments:

  • -t — -t option (Type): Specifies the key type. Values: ed25519, rsa, ecdsa, dsa. Example: ssh-keygen -t ed25519
  • -b — -b option (Bits): Sets the number of bits / key bits. Applies to RSA (2048 bits minimum, 4096 bits recommended) and ECDSA (256 bits, 384 bits, or 521 bits). Example: ssh-keygen -t rsa -b 4096
  • -C — (Comment): Sets the key comment appended to the public key. Use your email or a descriptive label. Example: ssh-keygen -t ed25519 -C "deploy-key-prod"
  • -f — [-f keyfile] (File / file name option): Specifies the output path. Overrides the interactive prompt. Example: ssh-keygen -f ~/.ssh/id_ed25519_github -t ed25519
  • -N — [-n new_passphrase] (New passphrase): Sets a new passphrase non-interactively. Use with -p to change passphrase. Example: ssh-keygen -p -f ~/.ssh/id_rsa -N "new_secure_phrase"
  • -p — -p option (Change passphrase): Changes the passphrase of an existing stored credential. Used with [-p old_passphrase] and [-n new_passphrase]. The old passphrase must be provided. Example: ssh-keygen -p -f ~/.ssh/id_rsa
  • -P — (Passphrase): Provides the old passphrase non-interactively when reading a key.
  • -e — -e option (Export): Reformats existing keys between the standard format and the format defined in RFC 4716 (SSH Public Key File Format). Useful for export operations and converting between formats. Also supports convert PEM workflows.
  • -i — (Input / input key): Reads an existing credential for reformatting. Pair with -e or -y.
  • -y — -y option: Reads a private key and prints the corresponding public key to stdout. Useful if you've lost the .pub file.
  • -l — -l option (Fingerprint): Prints the key fingerprint (SHA256 hash) of a specified public key. Example: ssh-keygen -lf ~/.ssh/id_ed25519.pub. Also shows the bubble babble fingerprint with -B.
  • -R — -r option (Remove host keys): Removes all keys for a given hostname from the known_hosts file. Useful after a host rebuild or IP change.
  • -F — (Find / hostname search): Searches for a hostname in the known_hosts records.
  • -v — verbose mode: Prints detailed debug output during operations.
  • -q — silent mode: Suppresses output. Useful in scripts.

Complete examples for the three most common scenarios:

# ED25519 (recommended) — generate ed25519 key pair
ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519 -N ""

# RSA 4096-bit — rsa 4096 with passphrase prompt
ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/.ssh/id_rsa

# ECDSA 521-bit
ssh-keygen -t ecdsa -b 521 -C "[email protected]" -f ~/.ssh/id_ecdsa

# Display SHA256 fingerprint of a public key
ssh-keygen -lf ~/.ssh/id_ed25519.pub

# Change passphrase on existing private key
ssh-keygen -p -f ~/.ssh/id_rsa -P "old_phrase" -N "new_phrase"

The -N "" flag sets no passphrase — appropriate for automated deploy keys and secure file-transfer account access, but not for interactive user keys where a strong passphrase should protect the stored credential. For HTTPS certificate creation on web servers, openssl (not ssh-keygen) is used instead — but the concepts of public key cryptography, key exchange, and digital access proof are shared across both ecosystems. HTTPS and secure shell both rely on asymmetric enciphering and digital access verification via certificates or raw key pairs.

For access verification in scaled environments, consider certificates signed by internal certificate authorities — these remove the need to distribute individual public keys to every host's authorized_keys file. Combine with a digital access management platform and audit tooling to satisfy cybersecurity regulatory frameworks and enforce access control at the account level. This approach supports key creation workflows that integrate directly with setup systems, turning individual key pairs into governed, auditable access tokens.

What are SSH keys, and why should I use them instead of passwords?

SSH keys are key pairs based on public key infrastructure (PKI) technology. They use asymmetric enciphering to prove your identity without transmitting a password — making them immune to brute-force and replay attacks. They also enable automating logins and single sign-on across many machines, which passwords cannot safely do. Use this online tool to generate SSH keys online and get started in seconds.

What is the most secure SSH key algorithm?

ED25519 is currently the recommended choice for new keys. It uses elliptic curve enciphering at 256 bits, is faster than RSA, produces smaller output files, and has strong resistance to side-channel attacks. For maximum compatibility with legacy systems, use RSA 4096-bit.

Should I use a passphrase for my SSH key?

Yes — always use a strong passphrase for interactive user keys. The key passphrase encrypts your stored private credential so that it's useless to an attacker even if stolen. For automated deployment keys in continuous-integration pipelines, no passphrase may be necessary, but store such keys as encrypted secrets in your CI platform and rotate them regularly.

Are my keys stored or transmitted when I use this tool?

No. This is a fully client-side, browser-based free tool. Your private key is not uploaded, not transmitted, and not stored anywhere. All enciphering operations run in your browser using the Web Crypto API. The generated keys exist only in your browser's memory until you download or copy them — and are gone when you close the tab. This tool also has offline PWA (progressive web app) and PWA support, so it continues to function without an internet connection after the first load.

How do I add my SSH key to GitHub?

Copy your public key using the copy button above (or cat ~/.ssh/id_ed25519.pub in the terminal). Go to GitHub → Settings → SSH and GPG keys → New SSH key. Paste the full text key and give it a title. For a github ssh key, use your account email as the -C comment when generating. For other code-hosting platforms, the process is identical via their preferences page.

What is a key fingerprint?

A key fingerprint is a short hash (typically SHA256) of the public key, displayed as a string of hex characters or a visual hash image. Fingerprints let you verify that a key is correct without comparing the entire key body. Use ssh-keygen -lf ~/.ssh/id_ed25519.pub to display the hash of any public key. The bubble babble fingerprint format (used by Tectia) provides an alternative human-readable representation.

Can I use keys generated here with PuTTY?

Yes, with a conversion step. PuTTY requires the PuTTY .ppk format — not the standard key format. Use PuTTYgen to import your downloaded credential and save private key in .ppk format. From PuTTY 0.78+, ED25519 keys can be imported directly. Once converted, you can use the key for terminal sessions and secure file transfer via WinSCP or FileZilla. A key converter is also available in PuTTYgen's Conversions menu for convert OpenSSH and convert PEM operations.

What is the id_rsa or id_rsa.pub file?

id_rsa is the default filename for an RSA private credential saved in your ~/.ssh/ (.ssh directory) under your home directory. The corresponding public key is id_rsa.pub. For ED25519 keys, the defaults are id_ed25519 and id_ed25519.pub. ECDSA keys default to id_ecdsa and id_ecdsa.pub, while DSA keys use id_dsa and id_dsa.pub. Use the -f flag (file name option) to specify a different path when you need multiple keys for different workflows or accounts.

Frequently Asked Questions

Why is ED25519 recommended over RSA?
ED25519 keys are shorter, generate almost instantly, and are considered at least as secure as a 3072-bit RSA key at a fraction of the size -- modern OpenSSH (7.6+) and virtually every current server support it. Use RSA only when you need compatibility with an older system that doesn't yet support ED25519.
Is the generated private key encrypted?
No -- it's written in unencrypted OpenSSH format, the same as running ssh-keygen without a passphrase. If you want passphrase protection (recommended for any key that will sit on disk long-term), run ssh-keygen -p -f your_key_file after saving it, or add one directly with your SSH client's key management.
How do I know the generated key actually works?
Every OpenSSH-format output this tool produces was verified during development against the real ssh-keygen tool -- generating a key here, then running ssh-keygen -y to derive the public key from the private key, produces an exact match, and ssh-keygen -l correctly reports the key's fingerprint. You can do the same check yourself with any key you generate.
Where do I put the public and private keys?
Add the public key line to ~/.ssh/authorized_keys on any server you want to access, or to a service like GitHub/GitLab's SSH key settings. Save the private key locally (commonly as ~/.ssh/id_ed25519 or id_rsa) with permissions restricted to your user only (chmod 600) -- SSH clients refuse to use a private key file that's readable by other users.
Is my key sent anywhere?
No. Both keys are generated and encoded entirely in your browser using the Web Crypto API -- nothing is transmitted, logged, or stored. Reload the page and they're gone, so save them before navigating away.