RunLocalTools

SSH Key Generator Online — Ed25519, RSA & ECDSA, Free and Local

Generate SSH key pairs in your browser: Ed25519, RSA, ECDSA, OpenSSH format with optional passphrase. Inspect, convert and audit keys. Nothing is uploaded.

What it does

This tool creates SSH key pairs and gives you the two files you need: a private key (like id_ed25519) and a public key (like id_ed25519.pub). You pick the algorithm, add a comment and an optional passphrase, and get keys in the same OpenSSH format ssh-keygen produces.

It also works on keys you already have. Paste or drop public keys, a whole authorized_keys file or a private key, and it shows the type, size and fingerprints, flags weak or duplicate keys, converts between formats, and can change or remove a passphrase.

Generate

  • Ed25519 (default), RSA at 2048, 3072, 4096 or 8192 bits, and ECDSA on P-256, P-384 or P-521
  • Optional passphrase, with an adjustable bcrypt round count
  • Bulk mode: up to 20 key pairs at once, downloaded as one zip with a ready-made authorized_keys
  • SHA256 and legacy MD5 fingerprints, as shown by ssh-keygen -l
  • Exports as PEM (PKCS#8, PKCS#1, SEC1, SPKI) and RFC 4716
  • An authorized_keys line builder (restrict, from=, command= and the no-* options) and copy-paste commands for ssh-copy-id, ~/.ssh/config and ssh-add

Inspect and audit

  • Reads OpenSSH one-liners, authorized_keys, known_hosts-style lines, RFC 4716 and PEM public keys
  • Flags RSA under 2048 bits, DSA keys and duplicates; exports a CSV report or a cleaned authorized_keys
  • Reads OpenSSH, PKCS#8 (including encrypted), PKCS#1 and SEC1 private keys, derives the public key, and checks that a private and public key match

How it works

Key generation uses your browser’s built-in WebCrypto API, which draws randomness from the operating system’s secure random source. The tool then writes the key out byte-for-byte in the OpenSSH key format (openssh-key-v1) and builds the public key line, fingerprints and PEM encodings itself.

A passphrase uses the same scheme as ssh-keygen: your passphrase is stretched with bcrypt_pbkdf and the private section is encrypted with AES-256-CTR. More rounds mean a stolen key file is slower to attack; 16 is the ssh-keygen default. Because bcrypt is not part of WebCrypto, the tool carries its own implementation, written to match the OpenBSD reference and tested against known vectors.

Fingerprints are the SHA-256 (or MD5) hash of the public key’s binary form, shown in the same notation OpenSSH uses.

How to use it

  1. Choose an algorithm. Ed25519 is the best default; choose RSA only if you must support very old software.
  2. Add a comment (for example you@laptop) and, optionally, a file name.
  3. Tick Protect with a passphrase and enter one (5 or more characters), or leave it off.
  4. Press Generate key pair.
  5. Download the private key and the .pub file, or use the zip.
  6. Save the private key as ~/.ssh/id_ed25519 and run chmod 600 ~/.ssh/id_ed25519.
  7. Install the public key: use the generated ssh-copy-id command, or paste the .pub line into your server’s ~/.ssh/authorized_keys or into GitHub, GitLab or your cloud provider’s SSH key settings.

To inspect keys, switch to Inspect & audit, choose Public keys or Private key, and paste or drop what you have.

Privacy: what stays local

Everything in this tool is local. Keys are generated, encrypted, parsed, converted and audited inside your browser tab, and there is no feature that sends anything over the network. The first time you download a zip, a small zip library is loaded from a CDN; that request carries none of your data.

What is remembered in your browser (IndexedDB and local storage, never sent anywhere):

  • your last-used settings (never passphrases)
  • the public keys you generate, and the public-key list you paste into the audit tab
  • generated private keys only if you tick “Remember generated private keys in this browser”. It is off by default, and keys without a passphrase would then be stored unencrypted

Private keys you paste or drop into the Inspect tab are never stored. A Clear all saved data button removes everything this tool has saved.

FAQ

Is it safe to generate an SSH key in a web page?

The key is created by your browser’s cryptographic API on your own device and never leaves the page, so the page cannot hand it to anyone. The remaining risk is the device itself and where you copy the key afterwards. If you want extra assurance, load the page, then disconnect from the internet before generating; the tool needs no network once loaded.

Ed25519, RSA or ECDSA — which should I choose?

Ed25519 for almost everything: the keys are short, fast and supported by OpenSSH 6.5 and later, and by GitHub, GitLab and the major clouds. Pick RSA (3072 bits or more) only for older systems that reject Ed25519. ECDSA is a reasonable middle option, but Ed25519 is usually preferred.

Does a passphrase really matter?

Yes. Without one, anyone who copies the private key file can use it. With one, the file is encrypted, and bcrypt makes each guess slow. Use a long, unique passphrase, for example one made with the password generator, and load the key into ssh-agent so you only type it once per session.

What is the difference between the public and private key files?

The .pub file is safe to share: that is the one you paste into servers and Git hosts. The private file (no extension) must stay secret. If GitHub says your key is invalid, you have usually pasted the private key, or copied a PEM block instead of the one-line ssh-ed25519 AAAA… text.

How do I check that two keys match, or compare fingerprints?

Open Inspect & audit → Private key, read your key, then paste a public key into the verify box. For fingerprints, a hash is computed from the public key; the same idea as the hash generator, applied to the key’s binary form and shown in OpenSSH notation.

Can I remove or change the passphrase on an existing key?

Yes. Read the key in Inspect & audit → Private key, open Re-export, enter a new passphrase (or leave it empty to remove it) and build the OpenSSH output. Everything happens in the page.

Supported formats and limitations

Reads: OpenSSH private keys (unencrypted, or encrypted with aes128/192/256-ctr + bcrypt, the ssh-keygen default), PKCS#8 (including PBES2-encrypted with AES-CBC), PKCS#1 RSA PRIVATE KEY, SEC1 EC PRIVATE KEY, and public keys as OpenSSH lines, RFC 4716 or PEM.

Writes: OpenSSH private and public keys, PKCS#8, PKCS#1, SEC1, SPKI PEM and RFC 4716. PEM private-key exports are never passphrase-protected; only the OpenSSH format supports a passphrase here.

Not supported: DSA keys for generation, hardware-backed (sk-) keys for generation, PuTTY .ppk files, legacy encrypted PEM (Proc-Type / DEK-Info), key files holding more than one key, OpenSSH chacha20-poly1305 or aes-gcm encrypted files, and unwrapping SSH certificates. DSA and hardware-backed public keys can still be read and fingerprinted.

Ed25519 generation needs a browser with Ed25519 in WebCrypto (current Chrome, Edge, Firefox and Safari). Very large RSA keys (8192 bits) can take a long time, and unlocking a key with a high bcrypt round count takes proportionally longer.