Ready-to-use OpenSSH keys
This generator creates an SSH key pair with the Web Crypto API and writes it in the native OpenSSH formats: the public key as a single authorized_keys line and the private key as an OPENSSH PRIVATE KEY file. It also shows the SHA256 fingerprint, the same value ssh-keygen -l prints, so you can confirm the key on servers and Git hosts.
Ed25519 is the default and the best choice for almost everyone. Pick ECDSA P-256 or RSA 4096 only for systems that do not support Ed25519.
Installing the key
- Download both files and move them to ~/.ssh, for Ed25519 as id_ed25519 and id_ed25519.pub.
- Restrict the private key with chmod 600 ~/.ssh/id_ed25519. SSH refuses keys that other users can read.
- Add a passphrase, which encrypts the private key file: ssh-keygen -p -f ~/.ssh/id_ed25519.
- Copy the public key to a server with ssh-copy-id, or paste it into GitHub, GitLab or your cloud provider.
Frequently asked questions
Is the private key encrypted?
No. The file is created without a passphrase, so run ssh-keygen -p on it to add one before you use it. For keys on production servers, generating directly with ssh-keygen is the safest route.
Ed25519 or RSA?
Ed25519. Keys are shorter, faster and secure by default. Use RSA 4096 only for old servers or devices without Ed25519 support, which OpenSSH added in version 6.5 back in 2014.