# SSH Key Generator Online - Ed25519, RSA & ECDSA

> Generate SSH key pairs in your browser: Ed25519, RSA 2048/3072/4096 or ECDSA, with OpenSSH keys, passphrases, PKCS#8, fingerprints and randomart.

- URL: https://qilingtools.com/en/ssh-keygen
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev), [DevOps](https://qilingtools.com/en/tags/devops)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Need an SSH key pair but don’t have a terminal at hand? This tool generates keys locally with your browser’s WebCrypto, never touching a server. It supports Ed25519 (recommended; browser support is detected automatically), RSA 2048, 3072 and 4096, and ECDSA P-256 and P-384. You get an OpenSSH public key with a comment, ready to paste into ~/.ssh/authorized_keys, and an openssh-key-v1 private key; with a passphrase it is encrypted exactly like ssh-keygen does, using bcrypt-pbkdf key derivation and aes256-ctr with adjustable rounds. PKCS#8 and SPKI PEM exports are available for OpenSSL and other software. The page shows the SHA256 fingerprint and randomart exactly as ssh-keygen -l prints them, plus commands for saving the private key, fixing permissions and installing the public key with ssh-copy-id. A second tab inspects any public key (an authorized_keys line or RFC 4716 format): type, bits, curve, comment, fingerprint and randomart, with warnings for DSA and short RSA keys. Keys live only in page memory and vanish when you close the page, but browser extensions or a compromised computer could still read them, so use ssh-keygen in your own terminal for production servers and other important keys.

## How to use

1. Pick an algorithm (Ed25519 recommended), enter a comment and optionally a passphrase
2. Click Generate key pair, download the private key id_xxx and public key id_xxx.pub, and check the fingerprint
3. Move the private key to ~/.ssh with chmod 600, then install the public key with ssh-copy-id or by appending it to authorized_keys

## Features

- Ed25519, RSA 2048/3072/4096, ECDSA P-256/P-384
- OpenSSH public keys and openssh-key-v1 private keys, optionally encrypted with bcrypt-pbkdf + aes256-ctr
- PKCS#8 / SPKI PEM export
- SHA256 fingerprint and randomart identical to ssh-keygen
- Inspect any public key: type, bits, fingerprint, security notes
- Commands for installing keys and setting permissions
- Generated locally with WebCrypto, never uploaded

## FAQ

### Is it safe to generate SSH keys in a web page?

Keys are generated locally from WebCrypto’s secure random source, the page never sends them anywhere, and they disappear on reload. A web page is still riskier than your own terminal, though: malicious extensions or a compromised computer could read page contents. Use it for testing, temporary environments and learning; for production servers, Git signing and long-lived keys, run ssh-keygen -t ed25519 on your own machine.

### Should I choose Ed25519 or RSA?

Prefer Ed25519: short keys, fast signatures and strong security, supported since OpenSSH 6.5 (2014). Use RSA only for old systems or devices without Ed25519, and make it at least 3072 bits. ECDSA suits environments that only accept NIST curves. If your browser lacks Ed25519, the tool says so and switches to ECDSA.

### Can I use the generated private key with ssh directly?

Yes. It is OpenSSH’s own openssh-key-v1 format, the same as files from ssh-keygen: save it in ~/.ssh/ and run chmod 600. Passphrase-protected keys use bcrypt-pbkdf with aes256-ctr, which ssh and ssh-add decrypt natively. Run ssh-keygen -y -f on the private key to derive the public key and compare.

### What are the fingerprint and randomart for?

The fingerprint is the SHA256 digest of the public key, used to confirm a key has not been swapped when you first connect to a server or hand your key to someone. Randomart draws the same digest as a picture that is easier to compare by eye. The output here matches ssh-keygen -lv exactly.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.