ES
Home › Developer Tools › SSH Key Generator

SSH Key Generator

Create a new SSH key pair right in your browser, the same kind ssh-keygen makes. Pick Ed25519 or RSA, add a comment, and download the OpenSSH private key and the public key line to paste into GitHub, GitLab or a server's authorized_keys. Keys come from your device's secure random generator and never leave the page.

Last updated:

Key type

Public key

share this

Private key

keep secret 

        
Randomart of the SHA256 fingerprint, as printed by ssh-keygen.

      

    

  


  

    
Next steps

    

    
  

  

  Advertisement
  



  










  Advertisement
  





How to use the SSH Key Generator


  1. Choose the key type. Ed25519 is short, fast and recommended; pick RSA 4096 for older systems that do not support Ed25519.
  2. Enter a comment such as your email or user@host so you can recognise the key later.
  3. Press Generate key pair. The key is created instantly in your browser.
  4. Download the private key and save it as ~/.ssh/id_ed25519 (or id_rsa), then run chmod 600 on it.
  5. Copy the public key and paste it into GitHub/GitLab SSH settings or append it to ~/.ssh/authorized_keys on the server.


Ed25519 vs RSA SSH keys






Ed25519RSA 3072 / 4096



Public key line lengthAbout 80 charactersAbout 550 / 730 characters


Security levelAbout 128-bitAbout 128-bit (3072) / higher (4096)


SpeedVery fast signing and verificationSlower, especially signing


SupportOpenSSH 6.5+ (2014), GitHub, GitLab, Bitbucket, modern cloud imagesPractically everything, including old servers and network devices


Default file name~/.ssh/id_ed25519~/.ssh/id_rsa







RSA keys shorter than 2048 bits are rejected by current OpenSSH releases. Note that the signature algorithm matters too: OpenSSH 8.8 and later disable the old SHA-1 ssh-rsa signatures by default, but RSA keys keep working through the SHA-2 based rsa-sha2-256 and rsa-sha2-512 algorithms, which use the same key files.



What the files contain


The public key line has three parts: the algorithm (ssh-ed25519 or ssh-rsa), the key encoded in base64, and your comment. You can share it freely; one line per key goes into ~/.ssh/authorized_keys on each server you want to log in to.


The private key file starts with -----BEGIN OPENSSH PRIVATE KEY-----. It is the format ssh-keygen has written by default since OpenSSH 7.8 and contains the secret key, a copy of the public key and the comment. Anyone with this file can log in as you, so never paste it into chats, tickets or repositories, and protect it with a passphrase.



Adding the key to GitHub or GitLab


    

  1. Copy the OpenSSH public key above (it starts with ssh-ed25519 or ssh-rsa).
    2. 

  2. On GitHub go to Settings → SSH and GPG keys → New SSH key; on GitLab go to Preferences → SSH Keys. Paste the key and save.
    3. 

  3. Save the private key as ~/.ssh/id_ed25519, run chmod 600 ~/.ssh/id_ed25519, then test with ssh -T [email protected].
    4. 




Frequently asked questions


Is it safe to generate an SSH key in the browser?
The key pair is created by your browser's WebCrypto API, which uses the operating system's cryptographically secure random number generator, the same source ssh-keygen relies on. Nothing is sent to a server. For keys protecting critical production systems, many teams still prefer running ssh-keygen on the machine that will use the key.


Should I use Ed25519 or RSA?
Use Ed25519 when you can: keys are short, signing is fast, and it is supported by OpenSSH 6.5 and later, GitHub, GitLab and Bitbucket. Choose RSA with at least 3072 or 4096 bits for older servers, network appliances or software that does not accept Ed25519.


Where do I save the private key?
On Linux and macOS save it as ~/.ssh/id_ed25519 (or ~/.ssh/id_rsa) and run chmod 600 on the file, otherwise ssh refuses to use it. On Windows save it in C:\Users\you\.ssh\. Keep the .pub file next to it.


How do I add a passphrase?
The generated private key is unencrypted. Protect it on your computer with ssh-keygen -p -f ~/.ssh/id_ed25519, which asks for a new passphrase and rewrites the file in encrypted form.


Which private key format should I pick?
The OpenSSH format (BEGIN OPENSSH PRIVATE KEY) is what modern ssh-keygen writes and works with OpenSSH, Git and most tools. PEM PKCS#1 (BEGIN RSA PRIVATE KEY) is the legacy RSA format some older tools and libraries require, and PKCS#8 (BEGIN PRIVATE KEY) is the generic format used by OpenSSL and many programming languages.


What is the SHA256 fingerprint?
It is the base64 SHA-256 hash of the public key, the same value ssh-keygen -lf and GitHub display. Compare it to confirm you added the right key. The randomart picture is a visual form of the same fingerprint.


Can I use the key with PuTTY?
PuTTY needs its own .ppk format. Open PuTTYgen, choose Conversions > Import key, load the OpenSSH private key file and save it as a .ppk private key.


Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.



Related tools



RSA Key GeneratorGenerate 2048, 3072 or 4096-bit RSA key pairs as PEM, PKCS#1, JWK or OpenSSH, locally.Password GeneratorCreate strong passwords and passphrases.API Key GeneratorCreate secure API keys and secrets with prefixes, checksums and SHA-256 hashes for storage.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.Kubernetes Secret GeneratorCreate Kubernetes Secret YAML from key/value pairs or .env with auto base64, or decode one.MD5 Hash GeneratorGenerate MD5 hashes of text, lines or files and verify checksums.SHA-256 Hash GeneratorSHA-256 and HMAC-SHA256 hashes of text, lines or files, in hex or Base64.Base64 Encoder DecoderEncode or decode Base64 text and files, and make data URIs.URL Encoder DecoderPercent-encode or decode URLs, query strings and form data.HTML Entity Encoder / DecoderEscape and unescape HTML entities, named or numeric.Bcrypt Hash Generator & CheckerCreate bcrypt password hashes and check a password against a hash.Binary TranslatorConvert text to binary, hex, octal and back.HMAC GeneratorGenerate and verify HMAC signatures with SHA-256, SHA-512, SHA-1 or MD5.CRC32 Checksum CalculatorCalculate CRC-32, CRC-32C, CRC-16 and Adler-32 checksums of text or large files.JWT DecoderDecode JSON Web Tokens, read the claims and expiry, and verify HS256 signatures.JWT GeneratorCreate and sign HS256, HS384 or HS512 JSON Web Tokens in your browser and verify them.Password Strength CheckerSee how strong a password really is, how long it takes to crack and how to improve it.Caesar CipherEncode and decode Caesar shift ciphers and crack unknown shifts with a ranked brute force.Vigenère CipherEncrypt and decrypt Vigenère and Autokey ciphers, and crack unknown keys with frequency analysis.Atbash CipherEncode and decode Atbash ciphers (A↔Z, B↔Y) in Latin or Hebrew, with a live letter mapping table.ASCII TableFull ASCII code chart 0–255 in decimal, hex, octal, binary and HTML, with search and copy.Unicode Character LookupFind Unicode characters by name or code point and copy them with UTF-8, HTML and code escapes.Punycode ConverterConvert international domain names, emails and URLs between Unicode and xn-- Punycode, in bulk.JSON Escape / UnescapeEscape text for a JSON string, unescape \n and \" back to text, or stringify a whole object.Binary to HexConvert binary to hex instantly with steps and signed mode.Hex to BinaryConvert hex to binary instantly with steps and signed mode.Binary CalculatorAdd, subtract, multiply, divide, AND, OR, XOR and shift binary numbers with decimal values.Hex CalculatorHexadecimal + − × ÷ and AND, OR, XOR, NOT, shifts with decimal and binary equivalents.Base32 Encoder / DecoderEncode and decode Base32 (RFC 4648), Base32hex, Crockford and z-base-32 from text, hex or files.Base58 Encoder / DecoderEncode and decode Base58 and Base58Check (Bitcoin alphabet) from text or hex, with checksum verification.Unicode Escape / UnescapeConvert text to \uXXXX, \u{...}, \x, &#...; or CSS escapes and decode them back.File Hash CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of files and verify them against a hash.TOTP GeneratorGenerate 2FA one-time codes from a secret key, create otpauth QR codes and verify codes.SSL Certificate DecoderDecode PEM SSL/X.509 certificates: subject, issuer, expiry, SANs, key and fingerprints.Text Encryption ToolEncrypt and decrypt text with a password using AES-256-GCM, entirely in your browser.Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d and verify them against an encoded hash.Base64 to PDFDecode a Base64 string to a PDF with preview and download, or encode a PDF to Base64.Bitwise CalculatorCalculate AND, OR, XOR, NOT and bit shifts at 8–64 bits with a bit grid and all bases.SHA-512 Hash GeneratorSHA-512 and SHA-384 hashes of text or files in hex or Base64, HMAC and hash verification.SRI Hash GeneratorCreate Subresource Integrity hashes (sha256/384/512) and ready <script> or <link> tags.String Escape / UnescapeEscape or unescape strings for JavaScript, Java, C#, Python, C, SQL, regex, CSV and shell.UTF-8 Encoder / DecoderConvert text to UTF-8 bytes in hex, decimal, binary, \x or % and decode bytes back to text.UUID Decoder & ValidatorDecode any UUID: version, variant, v1/v6/v7 timestamp and MAC node, plus bulk validation.Base64 to FileDecode Base64 or a data URI to a downloadable file; detects the real file type and previews it.File Encryption ToolEncrypt and decrypt any file with a password using AES-256-GCM, entirely in your browser.Passphrase GeneratorMake strong, memorable diceware passphrases from a 7,776-word list, with entropy in bits.CSR DecoderDecode a PEM certificate signing request: subject, SANs, key size, signature and CA readiness checks.Enigma Machine SimulatorEncrypt and decrypt with a virtual Enigma I, M3 or M4: rotors, rings, plugboard and lampboard.Hex Opacity CalculatorConvert opacity percent to a 2-digit HEX alpha code and full #RRGGBBAA color, with a 0-100% table.Playfair CipherEncrypt and decrypt Playfair ciphers from a keyword, with the 5x5 key square and every digraph step.Pwned Password CheckerCheck if a password appeared in data breaches; only 5 characters of its SHA-1 hash are sent.RSA Encryption ToolEncrypt text with an RSA public key and decrypt it with the private key using RSA-OAEP in your browser.SAML DecoderDecode SAMLRequest and SAMLResponse messages to readable XML, attributes and validity times.SSL Certificate ConverterConvert SSL certificates and keys between PEM, DER, PFX/P12 and P7B in your browser.Checksum CalculatorCompute 8-bit sum, two's complement LRC, XOR/BCC, NMEA, Fletcher and Internet checksums of bytes.PBKDF2 Hash GeneratorDerive PBKDF2 keys from a password, salt and iteration count with SHA-1, SHA-256 or SHA-512.Protobuf DecoderDecode raw Protocol Buffers hex or Base64 without a schema, or add a .proto for field names.XML Escape / UnescapeEscape & < > " ' for XML text and attributes, unescape entities back, or wrap text in CDATA.Binary Search Tree VisualizerInsert, delete and find in BST, AVL and red-black trees with animated rotations and traversals.CSR GeneratorCreate a certificate signing request (CSR) and private key with SANs, RSA or ECDSA, in your browser.MongoDB ObjectId to TimestampDecode a MongoDB ObjectId to its creation date, or build ObjectIds from dates for range queries.PGP Encrypt / DecryptEncrypt, decrypt, sign and verify PGP messages with your armored keys, entirely offline.PGP Key GeneratorGenerate an OpenPGP key pair (Curve25519, NIST ECC or RSA) with passphrase and expiry, offline.Quoted-Printable Encoder / DecoderEncode or decode quoted-printable email text (MIME) with UTF-8 and 76-character soft line breaks.Self-Signed Certificate GeneratorCreate a self-signed SSL certificate and key for localhost or dev servers, as PEM or PFX.SHA-1 Hash GeneratorSHA-1 and HMAC-SHA1 of text or files in hex or Base64, plus Git blob hashes and verify.



See all 65 Encoders, Hashes & Crypto →