Skip to content

SSH Key Generator

Generates an OpenSSH key pair with a comment and shows the fingerprint. The private key comes out unencrypted — add a passphrase locally with ssh-keygen -p.

The same key generator opened on its OpenSSH tab: an `authorized_keys` line and a matching `openssh-key-v1` private key, generated in the browser. Ed25519 by default, with ECDSA and RSA for hosts that want them.

🔒 Runs entirely in your browsersshkeyscrypto
Algorithm

Small, fast, modern. The default for SSH since 2014.

Appears at the end of the OpenSSH public key line.

Keys are generated by this browser’s own WebCrypto (crypto.subtle.generateKey) in this tab, and never leave it — nothing is transmitted, logged or stored. The formats are verified against OpenSSH itself in this project’s test suite. Generate on the machine that will hold the private key when you can; a key that has existed in a browser tab has existed in that tab’s memory.

How to use it

  1. Set a comment

    It goes at the end of the public key line — `you@machine` by convention. It is what lets you find the right line in an `authorized_keys` with a dozen entries in it two years from now.

  2. Copy the public key to the server

    One line, appended to `~/.ssh/authorized_keys` on the host. The private key stays with you.

  3. Save the private key and lock it down

    Download it as `id_key`, then `chmod 600 id_key` — ssh refuses a private key that other accounts can read — and `ssh-keygen -p -f id_key` to add a passphrase.

Common questions

Why is the private key not encrypted?

Encrypting an `openssh-key-v1` key needs bcrypt-pbkdf, and doing that here would mean claiming a KDF implementation this page cannot verify against OpenSSH for every parameter. Adding the passphrase locally with `ssh-keygen -p` uses OpenSSH’s own code, which is strictly better.

Should I really generate an SSH key in a browser?

For a throwaway host, a lab, or when you have no terminal to hand, it is a reasonable convenience — nothing is transmitted and the formats are verified against `ssh-keygen` itself in this project’s tests. For the key that opens production, use the terminal on the machine that will keep it.

The server still asks for a password.

Usually permissions: `~/.ssh` must be 700 and `authorized_keys` 600 on the host, and the private key 600 on yours. `ssh -v` says which check failed, and it is nearly always this one.

Can I use one key for several servers?

You can, and it is normal. The tradeoff is blast radius: one compromised private key opens everything it was installed on. A separate key per environment — laptop to production, CI to staging — costs one line each and limits the damage.

Feed it from

Key Pair Generator

Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.

Runs entirely in your browser

Next

These accept what this tool produces, so the result can go straight in.

Certificate Decoder

Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.

Runs entirely in your browser

Key Pair Generator

Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.

Runs entirely in your browser

Random Key Generator

Generates cryptographic random bytes as hex, Base64 or Base64URL at a chosen length, for app secrets.

Runs entirely in your browser

Base64 Encoder & Decoder

Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.

Runs entirely in your browser

curl to Code

Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.

Runs entirely in your browser

Text Hash

Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.

Runs entirely in your browser