How to use the SSH Key Generator
- Keep Ed25519 (or choose RSA 4096 for older servers).
- Set a comment, usually
you@machine. - Click Generate key pair.
- Save the private key as
~/.ssh/id_ed25519and add the public key to GitHub orauthorized_keys.
Installing the keys
# save the private key and lock it down
mv ~/Downloads/id_ed25519 ~/.ssh/
chmod 600 ~/.ssh/id_ed25519
# optional: add a passphrase
ssh-keygen -p -f ~/.ssh/id_ed25519
# on the server (or paste into GitHub → Settings → SSH keys)
cat id_ed25519.pub >> ~/.ssh/authorized_keysOpenSSH refuses private keys that other users can read, so chmod 600 is required. The ~/.ssh folder itself should be 700.
Ed25519, RSA or ECDSA?
| Type | Public key length | Notes |
|---|---|---|
| Ed25519 | ~80 characters | Recommended by GitHub and OpenSSH; fast and secure |
| RSA 4096 | ~720 characters | Works with very old servers and some hardware devices |
| ECDSA P-256 | ~140 characters | Supported widely; Ed25519 is usually preferred |
The fingerprint
The SHA256:… fingerprint shown above is what GitHub, GitLab and ssh-keygen -lf display for the key, so you can confirm you uploaded the right one. When connecting to a server for the first time, compare its host key fingerprint the same way.
Security notes
Keys are generated with the Web Crypto API and the OS random generator, and are never transmitted. The private key is unencrypted; add a passphrase with ssh-keygen -p and load it into ssh-agent for convenience. For production servers, generating keys locally with ssh-keygen -t ed25519 is equally easy if you prefer not to use a browser.
Need PEM or JWK formats for signing? Use the RSA key generator.
Tools that pair well with the SSH Key Generator
- Git Command Generator — Pick a task like “undo the last commit but keep my changes” or “rename a branch on GitHub”, fill in your branch names and get the exact Git commands — each line explained, risky steps flagged.
- Htpasswd Generator — Generate user:hash lines for HTTP Basic Authentication in Apache, Nginx, Traefik and Caddy — with bcrypt by default and nothing sent to a server.
- SSL Certificate Decoder — Paste a PEM certificate or a full chain to see who it was issued to, which domains it covers, when it expires and how it is signed — like openssl x509 -text, but readable.
- JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.
Frequently asked questions
Is it safe to generate SSH keys in a browser?
ssh-keygen on the machine itself.Why does SSH say “unprotected private key file”?
chmod 600 ~/.ssh/id_ed25519.