SSH & RSA Key Pair Generator

about this tool

Ed25519 unless something needs RSA

Ed25519 is the modern default for SSH. The keys are short, generation is instant, signing is fast, and the security is comparable to RSA at a far larger size. Every current version of OpenSSH supports it.

RSA is here because some older systems, appliances and managed services still insist on it. If you have a free choice, take Ed25519. If you must use RSA, 2048 bits is the usual minimum and remains fine; 4096 is slower to generate and to use for very little practical gain.

Two different encodings

A key pair comes out in two shapes, and they are not interchangeable.

The PEM files are the standard DER encoding wrapped in base64: PKCS#8 for the private key, SPKI for the public one. That is what most libraries and tools expect when they ask for a key file.

The OpenSSH line is a different format entirely, built from the key's own numbers rather than from the DER. It is the single line that goes in authorized_keys, and it is what a server reads. The two describe the same key in incompatible ways, which is why both are here.

The fingerprint

The fingerprint is the SHA-256 digest of the public key blob, printed exactly as ssh-keygen -l prints it. Use it to confirm the key on a server is the one you think it is, without comparing hundreds of base64 characters by eye.

Generate a real key locally

The private key is created in your browser with the platform's cryptographic random source and is never transmitted. That is genuinely true, and it is still not the right way to make a key that guards production access.

A private key that has existed in a browser tab has been through a process with extensions, a clipboard and a page cache. For anything that matters, run ssh-keygen -t ed25519 -C "you@example.com" on the machine that will use the key, so the private half never leaves it. Use this tool for a throwaway key, for a test fixture, or to see what the formats look like.