SSH Key Generator
Generate secure SSH key pairs (RSA, Ed25519, ECDSA) instantly in your browser. Free online tool with OpenSSH format output, no registration required.
What is an SSH key pair?
An SSH key pair consists of two cryptographically linked keys: a private key (kept secret on your device) and a public key (shared with servers). They enable secure, passwordless authentication to remote systems via the SSH protocol.
Which SSH key type should I choose?
Ed25519 is recommended for modern systems due to its superior security, smaller key size, and faster performance. RSA (4096-bit) offers maximum compatibility with legacy systems. ECDSA provides a good balance between security and key size for NIST-compliant environments.
Is it safe to generate SSH keys in the browser?
Yes. This tool uses the Web Crypto API, which provides cryptographically secure random number generation compliant with FIPS 140-2 standards. All key generation happens locally in your browser — no data is transmitted to any server.
What is an SSH key fingerprint?
A fingerprint is a short SHA-256 hash of your public key (e.g., SHA256:ABC123...). It's used to verify key identity, detect tampering, and confirm you're connecting to the correct server without exposing the full public key.
How do I use the generated SSH keys?
Save the private key to your ~/.ssh/ directory (e.g., id_ed25519) with permissions 600. Add the public key to the server's ~/.ssh/authorized_keys file. Then connect using: ssh user@server -i ~/.ssh/id_ed25519
What is the difference between RSA, Ed25519, and ECDSA?
RSA is the oldest and most widely supported, but requires larger keys (2048-4096 bits). Ed25519 is the newest, offering the best security with fixed 256-bit keys and fastest performance. ECDSA uses elliptic curve cryptography with variable key sizes (256-521 bits).
Should I set a passphrase for my SSH key?
Yes, always use a passphrase for private keys. It adds an extra layer of security if your key file is compromised. Modern SSH clients support ssh-agent to cache your passphrase, so you only enter it once per session.
What is OpenSSH format?
OpenSSH format is the standard text format used by OpenSSH tools. Private keys start with "-----BEGIN OPENSSH PRIVATE KEY-----" and public keys are single-line strings starting with "ssh-rsa", "ssh-ed25519", or "ecdsa-sha2-nistp256".
Can I convert these keys to other formats?
Yes. Use ssh-keygen to convert: ssh-keygen -p -m PEM -f id_ed25519 converts to PEM format. For PuTTY's .ppk format, use PuTTYgen. Most modern tools support OpenSSH format natively.
How often should I rotate SSH keys?
Best practice is to rotate SSH keys every 90 days to 1 year, depending on your security requirements. Immediately revoke and regenerate keys if you suspect compromise or when team members leave the organization.
What key size should I use for RSA?
Use at least 2048 bits for RSA keys. 4096 bits is recommended for high-security environments. Keys smaller than 2048 bits are considered insecure and may be rejected by modern SSH servers.
Why is Ed25519 preferred over RSA?
Ed25519 offers stronger security with smaller keys (256 bits vs 4096 bits for equivalent security), faster key generation and authentication, and is resistant to side-channel attacks. It's the modern standard recommended by security experts.