Generating a secure key pair should not require reading a man page. Our tool is designed to provide professional-grade configurations through an intuitive interface. Here is how you can create your keys step-by-step.

• Step 1: Select Your Key Type. Use the "Key type" dropdown to choose the cryptographic algorithm. We recommend "Ed25519" for modern, fast, and highly secure keys. If you need compatibility with older servers, select "RSA" or "ECDSA". Note that selecting different types will reveal context-specific options.
• Step 2: Configure Algorithm Parameters. If you chose RSA, use the "RSA key size" dropdown to select your bit length (we strongly suggest 4096 bits for strong security). If you chose ECDSA, pick your desired elliptic curve (like nistp256 or nistp521). The visual "Strength" badge in the top right will update automatically based on your choices.
• Step 3: Set Export Format and Passphrase. Choose your "Private key format". OpenSSH is the standard for almost all modern SSH clients. If you require PEM format (often needed for older AWS setups or specific CI/CD tools), select it from the list. If you choose PEM, you can optionally check "Encrypt PEM with passphrase" and enter a secure password to protect the private key file.
• Step 4: Add Metadata. Enter a "Key comment" (e.g., user@laptop-2026). This comment is appended to the public key and helps you identify it later in your server's authorized_keys file. You can also add detailed internal "Notes" (like rotation dates) which will be included if you download the JSON bundle.
• Step 5: Generate and Retrieve. Click the primary "Generate key pair" button. The server will securely compute the prime numbers or elliptic curves and return the results. You can now use the copy buttons to grab your "Public key" (to put on your server/GitHub) and "Private key" (to keep on your local machine), or download them directly as formatted files.

We designed this tool to go beyond basic generation. It includes features specifically requested by system administrators and DevOps engineers to streamline identity management.

1. Support for Modern Cryptography (Ed25519)

While RSA has been the standard for decades, Ed25519 (based on the Edwards-curve Digital Signature Algorithm) is the modern gold standard. Ed25519 keys are significantly smaller, making them easier to copy and paste, yet they offer cryptographic strength that rivals massive RSA keys. They also perform signatures much faster, which speeds up the SSH handshake process. Our tool fully supports generating these state-of-the-art keys using the native Sodium extension.

2. Flexible Formatting: OpenSSH vs. PEM

A common pain point when generating keys is realizing your software requires a specific file format. Modern Linux systems and Git clients prefer the newer OpenSSH format. However, legacy systems, certain language libraries (like older PHP or Python paramiko setups), and cloud provider dashboards sometimes demand the classic PEM format. Our SSH Key Generator allows you to explicitly choose how the private key block is wrapped, ensuring drop-in compatibility for your specific stack.

3. Instant Fingerprint Calculation

When you add a new key to a server or connect to a host for the first time, you are often asked to verify a fingerprint to prevent Man-in-the-Middle (MITM) attacks. Our tool automatically calculates and displays both the modern SHA256 (Base64) fingerprint and the legacy MD5 (Hex colon-separated) fingerprint the exact moment your key is generated. You do not need to run ssh-keygen -l -f locally to find this information.

4. Session History and Rapid Regeneration

If you are provisioning multiple servers or setting up keys for several team members, you might need to generate many pairs in a row. The tool features a "History" sidebar that temporarily stores the keys you generated during your current session. You can quickly click "Load" to swap between them. Furthermore, the "Regenerate" button allows you to instantly spin up a new mathematical key pair using your exact current settings with a single click.

5. Comprehensive JSON Bundling

For automation engineers, downloading raw text files isn't always helpful. We provide a "JSON bundle" export option. This downloads a single file containing your public key, private key, selected settings (like RSA bits or curve type), exact generation timestamp, calculated fingerprints, and any custom notes you added. This bundle is perfect for feeding into secrets management systems like HashiCorp Vault or AWS Secrets Manager.

Who uses a web-based SSH Key Generator? Here are specific scenarios where this tool saves valuable time and frustration.

• Label: Cloud Server Provisioning. You are spinning up a new Droplet on DigitalOcean or an EC2 instance on AWS via a web console on a tablet or a computer that isn't your primary workstation. You need a public key to inject via cloud-init, but you don't have access to a local terminal. You can generate the key pair here, paste the public key into the cloud dashboard, and download the private key to connect later.
• Label: CI/CD Pipeline Configuration. You are setting up GitHub Actions or GitLab CI to deploy code to your staging server via rsync or SSH. You need a dedicated, restricted key pair specifically for the CI runner. You can quickly generate an Ed25519 key here, paste the public half into the server's authorized_keys, and add the private half as a repository secret.
• Label: Assisting Non-Technical Users. You are an IT administrator trying to grant SFTP access to a freelance designer. Asking them to open PowerShell or Terminal to run ssh-keygen is a nightmare. Instead, you can generate the keys for them, securely transmit the private key (preferably encrypted with a passphrase), and apply the public key to their server account.
• Label: Legacy System Integration. You have inherited an old enterprise application that strictly requires a 2048-bit RSA key in PEM format to interact with a partner's API. Modern OS defaults often generate OpenSSH formats. You can use our tool to explicitly force the output to legacy PEM format and 2048 bits to ensure immediate compatibility.
• Label: Creating Deploy Keys for Repositories. You need to allow a specific server to clone a private Git repository, but you do not want to use your personal SSH key. You can generate a fresh key pair, add the public key to the repository as a "Deploy Key" with read-only access, and place the private key on the server.

While the command line is powerful, there are distinct advantages to using a visual generator, depending on your environment and requirements.

Cryptographic identity is sensitive. To ensure you are creating and managing your SSH keys correctly, follow these best practices.

Protect Your Private Key

The entire security model of SSH relies on the secrecy of the private key. Once you download or copy the private key from our tool, store it immediately in its final destination (like your ~/.ssh/ directory or a password manager). Never paste a private key into an email, Slack channel, or text document. On Linux/Mac, ensure you set the correct file permissions (chmod 600 ~/.ssh/id_rsa) or your SSH client will refuse to use it.

Understand Passphrase Encryption

If you choose to export in PEM format, you have the option to encrypt the private key file with a passphrase. If you do this, an attacker who steals the file cannot use it without also knowing the password. However, this means you will be prompted to type the password every time you initiate an SSH connection (unless you use an SSH Agent). For automated systems (like CI/CD pipelines), you generally must leave the key unencrypted.

Avoid RSA 2048 if Possible

While we offer RSA 2048 for legacy compatibility, computing power has increased to the point where 2048 bits is considered the absolute bare minimum for security, and is actively deprecated by many modern security audits. If you must use RSA, select 4096 bits. If your system supports it, skip RSA entirely and select Ed25519.

Have questions about key algorithms, formats, or security? Review our FAQ to understand the technical details behind the SSH Key Generator.