SSH Key Generator: Create an Ed25519 or RSA SSH key online

Three things: the public key as a single line (e.g. ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOqb9NdaBdneuqRd7QOYM6KYP5ZQlUq07JqHDlI7RY1I admin@mein-laptop), the private key in OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----), and the fingerprint, e.g. SHA256:f3J1EiY0bTdQMCH1DWyTodDOtoGE0abQW7po14q8jlE. You can copy both keys or download them as id_ed25519 and id_ed25519.pub.

The key pair is generated entirely in your browser using the Web Crypto API. There is no server request, storage, or logging; the Private Key never leaves this page. If you close the tab without saving the key, it's gone. If you'd rather generate the key entirely locally, use ssh-keygen -t ed25519 in the terminal.

Ed25519 is recommended: its keys are short, quick to generate, and supported by OpenSSH since version 6.5 (2014). Use 4096-bit RSA only if an older system, router, or service doesn't support Ed25519 yet. 3072 bits is the minimum we offer for new RSA keys; there is no 2048-bit option. If your browser cannot generate Ed25519 keys yet, the tool shows a notice and a button to switch to RSA.

It's optional but recommended. With a passphrase, the tool encrypts the private key just like ssh-keygen (bcrypt with 16 rounds, AES-256-CTR). Anyone who finds the file can't log in without the passphrase. Use ssh-agent so you don't have to enter it for every connection. You can change it later with ssh-keygen -p -f ~/.ssh/id_ed25519.

The easiest way is ssh-copy-id -i ~/.ssh/id_ed25519.pub root@<server-ip>. Alternatively, run the command shown by the tool on the server: it creates ~/.ssh, appends the line to ~/.ssh/authorized_keys, and sets permissions to 700 and 600 respectively. You can then log in without a password using ssh -i ~/.ssh/id_ed25519 root@<server-ip>.

Yes. The Public Key is a standard OpenSSH line (ssh-ed25519 or ssh-rsa, key, comment), just as ssh-keygen writes it to the .pub file. Add this line to your account's SSH key settings. The Private Key stays on your computer.

Store them in ~/.ssh/ on Linux and macOS, or in C:\Users\<Name>\.ssh\ on Windows. On Linux and macOS, the Private Key needs permissions of 600 (chmod 600 ~/.ssh/id_ed25519), or SSH will reject it. Windows 10 and 11 include OpenSSH, so the files work directly with ssh in the terminal. For PuTTY, import the Private Key into PuTTYgen (Conversions > Import key) and save it as a .ppk file; the tool itself only outputs OpenSSH format. Never share the Private Key; only the .pub file goes on the server.

The fingerprint is a short SHA-256 checksum of the public key, e.g. SHA256:f3J1EiY0bTdQMCH1DWyTodDOtoGE0abQW7po14q8jlE. It lets you identify a key without comparing the entire line. ssh-keygen -l -f ~/.ssh/id_ed25519.pub shows the same value.