SSH & Keys

SSH Key Generator

Key Pairs

Generate an SSH Key Pair

Choose a key type and options, then generate a secure public/private key pair.

Key type

Fastest & most secure — recommended for new keys on modern systems

Commentoptional

Passphraserecommended

Learn more

Guides & explainers related to this tool

Guide

How to Generate an SSH Key

Create, protect, and install a key pair step by step.

Article

SSH Keys Explained

How public and private keys work, and which algorithm to pick.

Tool features

Generate secure SSH key pairs with advanced configuration options
4 features

Three key algorithms

Ed25519, ECDSA, and RSA, with selectable key sizes for the latter two.

PEM and PPK output

Download the OpenSSH-format private key, or convert to PPK for PuTTY and WinSCP.

Passphrase encryption

Optionally encrypt the private key at rest, with a live strength meter.

SHA-256 fingerprint

Computed in your browser from the public key, so you can verify it matches elsewhere.

What is an SSH key & how it works

How public/private key authentication replaces passwords

An SSH key is a matched pair of cryptographic files: a public key you hand out freely and a private key you keep to yourself. Instead of sending a password, your client proves it holds the private key by signing a one-time challenge from the server. The server checks that signature against the public key listed in ~/.ssh/authorized_keys — so nothing reusable ever crosses the wire during login.

This tool runs OpenSSH's own ssh-keygen to produce the pair, then shows both halves along with a SHA-256 fingerprint. Ed25519 is the default because it yields short keys, verifies quickly, and has no parameter choices to get wrong. RSA stays available for older servers, network appliances, and CI systems that predate Ed25519 support.

Public key
The .pub half. Install it on servers or paste it into a Git host — it is safe to share.
Private key
The secret half. Anyone who copies this file can authenticate as you, so it never leaves your machine.
Passphrase
Encrypts the private key at rest, so a stolen key file is useless on its own.
Fingerprint
A SHA-256 hash of the public key, used to confirm two copies are the same key without comparing them byte by byte.

How to use this tool

Generate and install an SSH key pair in five steps
1
Choose a key type
Pick Ed25519 unless something in your stack requires otherwise. ECDSA and RSA reveal a key-size selector — use at least 2048 bits for RSA, 4096 if your servers can take it.
2
Add a comment and passphrase
The comment is a free-text label stored inside the public key (e.g. laptop@acme-corp) that helps you spot the key later in an authorized_keys file. The passphrase is optional but strongly recommended.
3
Generate the pair
Click Generate key pair. The private key stays blurred until you click to reveal it, so it is safe to run this on a shared screen.
4
Download both files
Set a base filename, then download the .pub public key and the private key as PEM — or PPK if you use PuTTY on Windows. Move both to ~/.ssh/ and run chmod 600 on the private key.
5
Install the public key
Run ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host, or paste the public key into the server's ~/.ssh/authorized_keys or your Git host's SSH settings.

Related tools

Keep debugging with tools from the same suite
4 tools
SSH Key Converter
Convert SSH keys between different formats (OpenSSH, PuTTY PPK, PEM)
SSH Key Validator
Validate SSH key format, structure, security, and verify public/private key matching
Git SSH Config Generator
Generate SSH configuration for Git repositories and multiple SSH keys management
Password Generator
Generate secure passwords with customizable length, complexity, and character sets

Frequently asked questions

Common questions about SSH keys, passphrases, and key formats
8 Q&A

Ed25519 for anything new. It produces a 68-character public key, signs and verifies faster than RSA, and has no key-size decision to get wrong. Choose RSA 4096 only when you hit a system that rejects Ed25519 — some older network appliances, Java-based SFTP servers, and legacy CI runners still do. ECDSA sits in between and is worth picking only if a compliance profile explicitly names a NIST curve.

Yes, for any key that reaches production. Without one, the private key file is a plaintext credential — anyone who copies it from a backup, a synced folder, or a stolen laptop can log in as you immediately. With one, they also need the passphrase. Add the key to your agent once with ssh-add and you will only type it once per session, so the day-to-day cost is close to zero.

Be deliberate about it. This tool generates the pair on our server with OpenSSH's ssh-keygen, writes it to a temporary directory, returns it over HTTPS, and deletes that directory immediately — the key is never written to a database or a log. But the private key does travel over the network, and your passphrase is sent with the request. That is fine for lab work, test environments, throwaway hosts, and learning. For a key that guards production infrastructure, run ssh-keygen -t ed25519 -C "you@example.com" on your own machine, where the private key is never transmitted at all.

They are two container formats for the same private key. PEM (the OpenSSH default) is what ssh, scp, rsync, and every Unix-like client expect at ~/.ssh/. PPK is PuTTY's own format, used by PuTTY, Pageant, and WinSCP on Windows. Download PEM unless you specifically use PuTTY — and note that converting between them does not change the key itself, only its wrapper.

Put both in ~/.ssh/ on the client machine. SSH refuses to use a private key with loose permissions, so run chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_ed25519. The public key is installed on the server instead, as a single line in that account's ~/.ssh/authorized_keys.

It is a SHA-256 hash of the public key, and it lets you confirm that two copies are the same key without comparing them character by character. Use it to check that the key you just pasted into GitHub matches the one on your laptop — run ssh-keygen -lf ~/.ssh/id_ed25519.pub locally and compare the string.

Copy the public key — never the private one — and paste it into Settings → SSH and GPG keys on GitHub, or Preferences → SSH Keys on GitLab. Then verify with ssh -T git@github.com. If it fails, check that the private key is in ~/.ssh/ with 600 permissions and loaded via ssh-add.

You can, and many people do, but it concentrates risk — one leaked private key exposes everything at once, and rotating it means touching every host. A reasonable middle ground is one key per device (laptop, desktop, CI runner) rather than one per server: revoking a lost laptop's key then locks out exactly that device everywhere.