SSH Key Generator

How to Use

1. Select a key type: RSA (2048 or 4096 bits) or ECDSA (P-256 or P-384).
2. Optionally add a comment (e.g., user@hostname) to identify the key.
3. Click Generate Key Pair — the keys are created instantly in your browser.
4. Copy or download the public key and add it to your server's ~/.ssh/authorized_keys file.
5. Copy or download the private key, save it to ~/.ssh/, and set permissions with chmod 600.

What Are SSH Keys?

SSH keys are pairs of cryptographic keys used for authenticating to remote servers without passwords. Each pair consists of a private key (kept secret on your machine) and a public key (shared with servers you want to access). When you connect, the server challenges you with a puzzle that only the holder of the private key can solve, proving your identity without transmitting any secrets.

SSH key authentication is more secure than password authentication because the private key never leaves your machine, it cannot be brute-forced like a password, and it is immune to phishing attacks. Most cloud providers (AWS, GCP, Azure, DigitalOcean) recommend or require SSH key authentication for server access.

How Asymmetric Cryptography Works

SSH keys use asymmetric (public-key) cryptography, where the two keys in a pair are mathematically linked but it is computationally infeasible to derive the private key from the public key. For RSA, this relies on the difficulty of factoring the product of two large prime numbers. For ECDSA, it relies on the discrete logarithm problem over elliptic curves. Both problems are considered intractable for sufficiently large key sizes with current computing technology.

RSA vs ECDSA vs Ed25519

RSA is the oldest algorithm, introduced in 1977, and remains the most widely supported. A 4096-bit RSA key provides a security level roughly equivalent to 140 bits of symmetric encryption. RSA keys are larger (800+ characters for 4096-bit) and slower to generate, but work with virtually every SSH implementation in existence.

ECDSA (Elliptic Curve Digital Signature Algorithm) uses elliptic curve mathematics to achieve equivalent security with much smaller keys. A P-256 ECDSA key (~88 characters) provides security comparable to a 3072-bit RSA key. ECDSA is faster for both key generation and authentication. P-256 and P-384 are the most common curves, standardized by NIST.

Ed25519 is the modern recommendation for SSH keys. It uses the Curve25519 elliptic curve with the EdDSA signature scheme, offering the best performance, smallest key size, and resistance to several classes of implementation vulnerabilities that affect ECDSA. Unfortunately, the Web Crypto API does not yet support Ed25519, so this tool cannot generate them — use ssh-keygen -t ed25519 on your local machine instead.

Setting Up SSH Keys

After generating a key pair, save the private key to your local ~/.ssh/ directory and set strict permissions:

• chmod 700 ~/.ssh — directory must be accessible only by you
• chmod 600 ~/.ssh/id_rsa — private key must be readable only by you
• chmod 644 ~/.ssh/id_rsa.pub — public key can be world-readable

Copy the public key to the remote server by appending it to ~/.ssh/authorized_keys. The easiest method is ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname. For cloud services like GitHub, AWS, or GitLab, paste the public key into their web interface under SSH key settings.

Security Best Practices

• Never share your private key. Treat it like a password. If compromised, revoke it immediately by removing its corresponding public key from all authorized_keys files.
• Use a passphrase. Adding a passphrase to your private key provides a second layer of protection if the key file is stolen. Use ssh-keygen -p -f ~/.ssh/id_rsa to add a passphrase after generation.
• Use one key per device. Generate separate key pairs for each computer or service. This allows you to revoke access for a single device without affecting others.
• Prefer Ed25519 for production. Generate Ed25519 keys with ssh-keygen -t ed25519 when your infrastructure supports it. Fall back to RSA 4096 for maximum compatibility.
• Rotate keys periodically. Replace SSH keys every 1-2 years, especially for high-security systems. Remove old public keys from servers when rotating.
• Disable password authentication. Once SSH keys are set up, disable password login in /etc/ssh/sshd_config by setting PasswordAuthentication no.

Key Formats Explained

This tool exports the private key in PKCS#8 PEM format, a standard encoding that works with OpenSSH 7.8+ and most other SSH clients. Older OpenSSH versions used a custom PEM format (beginning with -----BEGIN RSA PRIVATE KEY-----), but PKCS#8 (beginning with -----BEGIN PRIVATE KEY-----) is the modern standard and is supported by OpenSSH, PuTTY (via conversion), and all major libraries.

The public key is in OpenSSH format — a single line starting with the algorithm name (e.g., ssh-rsa or ecdsa-sha2-nistp256), followed by base64-encoded key data, and an optional comment. This is the format used in ~/.ssh/authorized_keys files and by services like GitHub and GitLab.

Related Tools

Generate secure passwords with the Password Generator. Compute SHA-256 hashes with the Hash Generator. Calculate Unix file permissions with the Chmod Calculator. Encode binary data with the Base64 Encoder.