Skip to content
JustTools

SSH Key Generator

Create an SSH key pair without installing anything. Pick the key type, add a comment and a passphrase, and download the private and public keys — made entirely in your browser.

Runs in your browser Free · no sign-up

At a glance

  • Generates SSH key pairs in the browser: Ed25519 (recommended), RSA 2048, 3072 or 4096, and ECDSA P-256, P-384 or P-521.
  • Writes the private key as OpenSSH, PuTTY .ppk (version 3), PEM PKCS#8 or traditional PEM, and the public key as one line for authorized_keys.
  • Protects the private key with an optional passphrase — bcrypt and AES-256 for OpenSSH, Argon2id for PuTTY, PBKDF2 for PKCS#8.
  • Shows the SHA-256 and MD5 fingerprints and the same randomart picture that ssh-keygen -lv prints.
  • Keys are checked against the real tools: ssh-keygen reads the generated files, derives the same public key and prints the same fingerprint.
  • An Ed25519 public key is only 68 characters of Base64; an RSA 4096 one is 716.
  • Made with your browser’s own cryptography (Web Crypto). The private key is never uploaded, stored or logged, and is gone when you close the tab.

Step by step

How to generate an SSH key

  1. 1

    Choose the key type

    Keep Ed25519 unless a server or device needs RSA or ECDSA.

  2. 2

    Add a comment and passphrase

    The comment labels the key (your email works well). A passphrase encrypts the private key so a stolen file is useless.

  3. 3

    Generate

    Press Generate key pair. Ed25519 is instant; RSA 4096 takes a few seconds.

  4. 4

    Save both files

    Download the private key into your .ssh folder and keep it secret. Copy the public key to the server, GitHub or GitLab.

Features

Everything you need, nothing you don’t

Every common key type

Ed25519 for new keys, RSA for old servers, ECDSA where NIST curves are required.

OpenSSH, PEM or PuTTY

Download the format your tool wants — no separate conversion step.

Passphrase protection

Encrypt the private key before it ever touches your disk.

Fingerprint and randomart

Verify the key against what your server or Git host shows.

Change without regenerating

Edit the comment, passphrase or format and keep the same key.

Nothing leaves the page

No server takes part. The private key is hidden on screen until you choose to show it.

Which SSH key type should I use?

TypePublic key lengthUse it when
Ed2551968 charactersAlways, unless something refuses it. Fast, small and secure.
RSA 4096716 charactersAn old server, appliance or cloud service accepts only RSA.
RSA 2048372 charactersA system limits the key size. The smallest RSA still accepted.
ECDSA P-256140 charactersA policy or hardware token requires NIST curves.

Where the files go

  • The private key (id_ed25519) lives in the .ssh folder of your home directory and must be readable only by you: chmod 600 ~/.ssh/id_ed25519.
  • The public key (id_ed25519.pub) is added as one line to ~/.ssh/authorized_keys on each server you log in to. ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server does this for you.
  • For GitHub or GitLab, paste the public key under Settings → SSH keys, then test with ssh -T git@github.com.
  • For PuTTY and WinSCP, choose the .ppk format and load the file under Connection → SSH → Auth → Credentials.

The same key with ssh-keygen

On a computer with OpenSSH installed, the command line does the same job: ssh-keygen -t ed25519 -C "you@example.com" for Ed25519, or ssh-keygen -t rsa -b 4096 for RSA. The files from this page are in the same formats, and ssh-keygen -y -f id_ed25519 will print the public key back from the private one.

Is it safe to generate a key in the browser?

This page has no server side. The key is made by your browser’s cryptography from its secure random-number generator, and it is never sent, saved or logged — you can open the browser’s network panel and see that nothing is transmitted when you press Generate.

That said, the safest key is one that never leaves the machine that uses it. For keys that guard production systems, generate them on that machine with ssh-keygen, and always set a passphrase. Use this page when you cannot install tools, need a .ppk quickly, or want a key for testing.

FAQ

Frequently asked questions

Should I choose Ed25519 or RSA?

Ed25519. It is shorter, faster and at least as secure as RSA 4096, and every current SSH server, GitHub, GitLab and Bitbucket accept it. Choose RSA only for older systems that do not.

Do I need a passphrase?

It is strongly recommended. Without one, anyone who copies the private key file can log in as you. With one, the file is encrypted and useless without the passphrase. An SSH agent means you type it only once per session.

How do I add the key to GitHub?

Copy the public key, open GitHub → Settings → SSH and GPG keys → New SSH key, paste it and save. Then run ssh -T git@github.com to check the connection.

How do I use the key with PuTTY?

Choose PuTTY (.ppk) as the private key format, download the file, and select it in PuTTY under Connection → SSH → Auth → Credentials. To convert an existing key instead, use the PEM to PPK converter.

What is the fingerprint for?

It is a short hash of the public key. Servers and Git hosts show it so you can confirm, at a glance, that they hold the key you think they do. The randomart is the same fingerprint drawn as a picture.

I lost the passphrase. Can it be recovered?

No. The private key is encrypted with it and there is no back door. Generate a new key pair and replace the old public key on your servers.

Can I change the comment or passphrase later?

Yes. On this page, edit them and press Update the files to keep the same key. For a key you already saved, ssh-keygen -p -f id_ed25519 changes the passphrase and -c the comment.

Is my private key sent to your server?

No. There is no server involved: generation happens in your browser, and the key exists only in this tab until you download it.

Keep going

Related tools

New

PEM to PPK Converter

Convert a PEM or OpenSSH private key (id_rsa, AWS .pem) to a PuTTY .ppk file online — PPK v3 or v2, with an optional passphrase. Free, private, no upload.

Security ToolsOpen
New

PPK to PEM Converter

Convert a PuTTY .ppk private key to PEM or OpenSSH format online, with or without a passphrase. Supports PPK v2 and v3, RSA, ECDSA and Ed25519. No upload.

Security ToolsOpen
New

Password Generator

Generate strong, random passwords, memorable passphrases and PINs with a cryptographically secure generator. Free, instant and private — nothing is stored.

Security ToolsOpen
New

Bcrypt Generator & Checker

Generate bcrypt hashes with cost 4–16 and $2a/$2b/$2y prefixes, or check a password against a bcrypt hash. Explains each part. Runs in your browser only.

Security ToolsOpen
New

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3, CRC32 and HMAC hashes of text or files, and verify checksums. Free, fast and private — no upload.

Developer ToolsOpen
New

SSL Checker

Check any website’s SSL certificate: expiry date and days left, issuer, covered domains, revocation and CAA, plus a live HTTPS test from your browser.

Security ToolsOpen

Browse every tool

Last updated Report a problem or suggest a feature