Is it safe to generate SSH keys in a web page?

Keys are generated locally from WebCrypto’s secure random source, the page never sends them anywhere, and they disappear on reload. A web page is still riskier than your own terminal, though: malicious extensions or a compromised computer could read page contents. Use it for testing, temporary environments and learning; for production servers, Git signing and long-lived keys, run ssh-keygen -t ed25519 on your own machine.

Should I choose Ed25519 or RSA?

Prefer Ed25519: short keys, fast signatures and strong security, supported since OpenSSH 6.5 (2014). Use RSA only for old systems or devices without Ed25519, and make it at least 3072 bits. ECDSA suits environments that only accept NIST curves. If your browser lacks Ed25519, the tool says so and switches to ECDSA.

Can I use the generated private key with ssh directly?

Yes. It is OpenSSH’s own openssh-key-v1 format, the same as files from ssh-keygen: save it in ~/.ssh/ and run chmod 600. Passphrase-protected keys use bcrypt-pbkdf with aes256-ctr, which ssh and ssh-add decrypt natively. Run ssh-keygen -y -f on the private key to derive the public key and compare.

What are the fingerprint and randomart for?

The fingerprint is the SHA256 digest of the public key, used to confirm a key has not been swapped when you first connect to a server or hand your key to someone. Randomart draws the same digest as a picture that is easier to compare by eye. The output here matches ssh-keygen -lv exactly.

💠

💠SSH Key Generator Online - Ed25519, RSA & ECDSA

Need an SSH key pair but don’t have a terminal at hand? This tool generates keys locally with your browser’s WebCrypto, never touching a server. It supports Ed25519 (recommended; browser support is detected automatically), RSA 2048, 3072 and 4096, and ECDSA P-256 and P-384. You get an OpenSSH public key with a comment, ready to paste into ~/.ssh/authorized_keys, and an openssh-key-v1 private key; with a passphrase it is encrypted exactly like ssh-keygen does, using bcrypt-pbkdf key derivation and aes256-ctr with adjustable rounds. PKCS#8 and SPKI PEM exports are available for OpenSSL and other software. The page shows the SHA256 fingerprint and randomart exactly as ssh-keygen -l prints them, plus commands for saving the private key, fixing permissions and installing the public key with ssh-copy-id. A second tab inspects any public key (an authorized_keys line or RFC 4716 format): type, bits, curve, comment, fingerprint and randomart, with warnings for DSA and short RSA keys. Keys live only in page memory and vanish when you close the page, but browser extensions or a compromised computer could still read them, so use ssh-keygen in your own terminal for production servers and other important keys.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use SSH Key Generator

1Pick an algorithm (Ed25519 recommended), enter a comment and optionally a passphrase
2Click Generate key pair, download the private key id_xxx and public key id_xxx.pub, and check the fingerprint
3Move the private key to ~/.ssh with chmod 600, then install the public key with ssh-copy-id or by appending it to authorized_keys

FAQ

Is it safe to generate SSH keys in a web page?: Keys are generated locally from WebCrypto’s secure random source, the page never sends them anywhere, and they disappear on reload. A web page is still riskier than your own terminal, though: malicious extensions or a compromised computer could read page contents. Use it for testing, temporary environments and learning; for production servers, Git signing and long-lived keys, run ssh-keygen -t ed25519 on your own machine.
Should I choose Ed25519 or RSA?: Prefer Ed25519: short keys, fast signatures and strong security, supported since OpenSSH 6.5 (2014). Use RSA only for old systems or devices without Ed25519, and make it at least 3072 bits. ECDSA suits environments that only accept NIST curves. If your browser lacks Ed25519, the tool says so and switches to ECDSA.
Can I use the generated private key with ssh directly?: Yes. It is OpenSSH’s own openssh-key-v1 format, the same as files from ssh-keygen: save it in ~/.ssh/ and run chmod 600. Passphrase-protected keys use bcrypt-pbkdf with aes256-ctr, which ssh and ssh-add decrypt natively. Run ssh-keygen -y -f on the private key to derive the public key and compare.
What are the fingerprint and randomart for?: The fingerprint is the SHA256 digest of the public key, used to confirm a key has not been swapped when you first connect to a server or hand your key to someone. Randomart draws the same digest as a picture that is easier to compare by eye. The output here matches ssh-keygen -lv exactly.