SSH Key Generator
Generate Ed25519 or RSA SSH key pairs in OpenSSH format — entirely in your browser
About this tool
The SSH Key Generator creates Ed25519 or RSA key pairs directly in your browser using the WebCrypto API, formatted exactly as OpenSSH expects — no separate conversion step needed. The public key comes out as a single-line `ssh-ed25519 AAAA...` or `ssh-rsa AAAA...` string ready to paste into a server's authorized_keys file or a Git host's SSH key settings. The private key comes out ready to save as-is: Ed25519 keys are written in the real OPENSSH PRIVATE KEY container format, and RSA keys as PKCS8 PEM, which OpenSSH (7.6+) reads natively. Both formats were verified byte-for-byte against the real ssh-keygen tool during development — the public keys and SHA256 fingerprints it derives from ToolNinja-generated private keys match exactly, confirming genuine interoperability rather than just visually-plausible output. Ed25519 is the modern recommendation for new keys: shorter, faster, and free of several implementation pitfalls that have affected RSA and ECDSA over the years. RSA remains available for the (increasingly rare) systems that don't yet support Ed25519.
When to use it
- →Generating a new Ed25519 key for a fresh GitHub, GitLab, or server SSH setup
- →Creating a dedicated deploy key for a CI/CD pipeline without touching your personal key
- →Getting an RSA key pair for a legacy system that doesn't support Ed25519
- →Generating a disposable key pair for testing SSH configuration locally
Tips
- ◆Prefer Ed25519 over RSA for any new key — it's shorter, faster to verify, and the current best-practice default across GitHub, GitLab, and OpenSSH itself.
- ◆The private key never leaves your browser during generation, but once downloaded it's a real credential — store it like any other SSH private key (correct file permissions, never committed to a repo).
- ◆Add a comment (typically an email or hostname) to make it easy to identify which key is which later, especially if you'll have several in your authorized_keys file.
Frequently asked questions
Is this actually compatible with real SSH clients and servers?
Yes — both the Ed25519 and RSA output were verified directly against ssh-keygen during development: deriving the public key from a ToolNinja-generated private key with `ssh-keygen -y` produces an identical result, and `ssh-keygen -l` computes the same SHA256 fingerprint. The keys are genuinely standard, not just formatted to look correct.
Why does the RSA private key look different from the Ed25519 one?
Ed25519 keys are written in the newer OPENSSH PRIVATE KEY container format (the same one `ssh-keygen` produces by default today). RSA keys are written as PKCS8 PEM (`BEGIN PRIVATE KEY`), which modern OpenSSH (7.6 and later) reads directly without conversion — both are fully standard, just different historical formats for the two algorithms.
Should I use 2048-bit or 4096-bit RSA?
2048-bit is the current baseline and is still considered secure — most systems default to it. 4096-bit adds a meaningful security margin at the cost of slower key operations and a larger key size; use it only if a specific compliance requirement calls for it. For new keys generally, Ed25519 is preferable to either.
Is my private key ever sent anywhere?
No. Key generation happens entirely client-side via the browser's WebCrypto API. Nothing is transmitted to a server at any point — but once you copy or download the key, treat the file itself with the same care as any other SSH private key.