SSH Key Generator

How to use it

1. Pick the Key type: RSA 2048, RSA 4096, or Ed25519 where the browser supports it.
2. Type a Comment such as user@host. It is appended to the public key line, exactly as ssh-keygen -C does.
3. Click Generate. The page builds the key with the Web Crypto API and reports how long it took.
4. Copy the public key line into ~/.ssh/authorized_keys on the server, or give it to whoever manages access.
5. Download the private key immediately and store it in your own password manager or key store. It exists only in this page's memory until you do.

Common use cases

• Adding access to a server - produce a fresh public key line without installing a toolchain on a locked-down machine.
• Rotating a key after a device change - generate a new pair, upload the public key, remove the old one.
• Separate keys per service - a distinct pair per host keeps a leaked key from opening everything.
• Checking the format before pasting - the authorized_keys line is shown in the exact shape the server expects.
• Working on a machine without ssh-keygen - a browser with Web Crypto is enough for RSA keys.

Why it stays private

The key pair is created by the browser's own Web Crypto implementation. The private key is never uploaded, never written to localStorage and never logged; it lives in memory for as long as the tab is open. That is why the page asks you to download it yourself - there is no server-side copy to recover later. Close the tab and the key is gone for good, which is the behavior you want from a key generator you did not install.

FAQ

Q: Is the private key uploaded or saved anywhere? A: No. Nothing is transmitted and nothing is persisted. The private key is only in the textarea and in the downloaded file you create yourself.

Q: Why is Ed25519 sometimes unavailable? A: Ed25519 in Web Crypto is not implemented by every browser yet. When generation is not supported, the tool reports that clearly rather than producing an RSA key under the Ed25519 name. Generating a key with a mismatched label would break the trust you place in the authorized_keys entry.

Q: Is the private key in OpenSSH's own format? A: No. It is exported as PKCS#8 PEM, which is what Web Crypto provides. Many tools accept it directly; OpenSSH can import it with ssh-keygen -i -m PKCS8 if you need the native format.

Q: Does the tool verify the key after generating it? A: It reports the key type, generation time and public key length. It does not perform a test signature, so treat the first login as your real check.