An SSH key pair is created right in your browser with WebCrypto: a public key for authorized_keys, a private key in OpenSSH format, the SHA256 fingerprint and the equivalent ssh-keygen command.
🔒 Keys are created in your browser and are never sent anywhere.
Ed25519 is recommended: short, fast and supported by OpenSSH since 6.5. RSA is for very old systems (use 3072 or 4096), ECDSA when NIST curves are required. The private key is given in OpenSSH format (openssh-key-v1) without a passphrase for every type, and ssh, ssh-keygen and ssh-agent can read it.
⚠ The key was created in a browser. For production servers it is safer to run ssh-keygen locally, and never publish the private key. You can add a passphrase after creation.
How to use
Choose the key type and, if you like, change the comment (it is appended to the public key, usually user@host). Press Generate. Add the public key to ~/.ssh/authorized_keys on the server, save the private key as ~/.ssh/id_ed25519 and lock it down: chmod 600 ~/.ssh/id_ed25519. The Download buttons save files under the proper names.
Which type to choose
Ed25519 is the default choice: a 32-byte key, fast signatures and no weak parameters.
RSA 3072/4096 is for old equipment and software that does not know Ed25519. 2048 bits is still acceptable but at the limit.
ECDSA P-256/384/521 uses NIST curves and is for places where a security policy requires them.
Formats and fingerprint
The public key is one line: type, base64 key and comment (encoded per RFC 4253, RFC 5656 and RFC 8709). The private key is stored in the modern -----BEGIN OPENSSH PRIVATE KEY----- format (openssh-key-v1, unencrypted). The SHA256:... fingerprint is the SHA-256 of the public key in base64 without "=" padding; it is what ssh-keygen -l and the server show on first connection.
Security
Keys are created on your side by the browser's generator and the page sends nothing to a server. Still, a private key is a secret: do not send it by email or in chats. For production servers it is better to create the key locally with ssh-keygen and protect it with a passphrase: ssh-keygen -p -f ~/.ssh/id_ed25519. For passwords and PINs there is the password generator.
FAQ
Is it safe to generate an SSH key in a browser?
Randomness comes from the browser's cryptographic generator (WebCrypto) and the page sends nothing to a server. Still, for important servers it is safer to create the key with ssh-keygen on your own computer so it never passes through a browser, extensions or the clipboard.
Which is better, Ed25519 or RSA?
Ed25519 is shorter, faster and more modern, and OpenSSH has supported it since 6.5 (2014). Use RSA only for legacy systems, preferably 3072 or 4096 bits.
How do I add a passphrase to a downloaded key?
Save the private key as ~/.ssh/id_ed25519 and run ssh-keygen -p -f ~/.ssh/id_ed25519: it asks for a new passphrase and encrypts the key with it.
What is the SHA256:... key fingerprint?
It is a short SHA-256 hash of the public key in base64. It is used to verify the key on first connection to a server and in key lists on GitHub and GitLab. ssh-keygen -lf id_ed25519.pub prints the same value.
Why can't I create an Ed25519 key?
Current versions of Chrome, Edge, Firefox and Safari support Ed25519 in WebCrypto. In an older browser choose RSA or ECDSA, or update the browser.