Advertisement
Guide
About the SSH & RSA Key Pair Generator
A key pair is two matching keys: a public key you can give to anyone — GitHub, a server, a JWT verifier — and a private key you keep secret. Anything signed with the private key can be checked with the public one. SSH uses this to log you in without a password.
This generator creates the pair with your browser’s built-in Web Crypto API and writes it in the formats tools expect: OpenSSH for ssh, PEM for OpenSSL and most libraries, and JWK for JSON-based systems.
Ed25519 or RSA?
Ed25519 is the modern default for SSH: keys are short, signing is fast, and it is supported by GitHub, GitLab and every OpenSSH release since 2014. Choose RSA (3072 or 4096 bits) only for old systems that do not accept Ed25519. ECDSA P-256 is common in TLS certificates and for ES256 JSON Web Tokens.
Key formats
- OpenSSH —
ssh-ed25519 AAAA…public keys andBEGIN OPENSSH PRIVATE KEYfiles, used by ssh and Git. - PEM — Base64 DER between BEGIN/END lines: PKCS#8 for private keys, SPKI for public keys. Used by OpenSSL, Node, Java and most libraries.
- JWK — the key as JSON, used for JWT signing and JWKS endpoints.
How to use it
- 1Pick a key type — Ed25519 for SSH unless you need RSA.
- 2Set a comment, usually your email or machine name.
- 3Generate the pair and choose a format.
- 4Download both files, protect the private key, and share only the public key.
Frequently asked questions
Is it safe to generate an SSH key in a browser?
Keys are created by the browser’s Web Crypto API on your device and are never sent or saved by this site. For keys that protect production systems, generating them on the machine itself with ssh-keygen avoids the key ever existing elsewhere.
Is the private key encrypted?
No, it is written without a passphrase. Add one after saving with ssh-keygen -p -f ~/.ssh/id_ed25519.
How do I add the key to GitHub?
Copy the public key (the .pub file), open GitHub → Settings → SSH and GPG keys → New SSH key, and paste it. Never upload the private key.
What size should an RSA key be?
At least 2048 bits; 3072 is ssh-keygen’s default and 4096 gives extra margin. Ed25519 is stronger than RSA 3072 and much smaller.
What is the fingerprint?
A SHA-256 hash of the public key, shown the same way ssh-keygen -l and GitHub display it, so you can confirm which key is which.