SECURITY / LOCAL KEY GENERATION

SSH Key Generator

Generate an Ed25519 or RSA key pair for SSH entirely in your browser. Download compatible OpenSSH files and compare the public key’s SHA256 fingerprint.

Key settings

Choose an algorithm and generate a key pair.

Use your key to connect

Generate and download your key pair above. Save both files on your computer, then prepare these commands. The server instructions apply to a Linux / Unix SSH account. Commands are generated locally and run only when you paste them into your terminal.

Enable JavaScript to prepare commands for your connection.

Save this connection in SSH config

Merge this specific Host block into your local , before general Host * defaults. It contains your connection settings and key filename, never the private key itself. Existing matching blocks can take precedence; inspect the effective settings with ssh -G.

Connect using the saved host alias:

Preview the effective settings; this command does not open a connection:

OpenSSH client configuration guide

Install only the public .pub file in your server account’s ~/.ssh/authorized_keys. Protect the private download on your computer; never upload it to the server.

Troubleshooting and first connection

Permission denied (publickey): check the username, SSH port, chosen private file, and matching public key in that account’s authorized_keys. The server must allow public-key authentication. The install step needs existing access to that account.

Bad permissions: restrict the private file to your user. On the Linux server, ~/.ssh should be 700 and authorized_keys 600, owned by the login account. If public-key installation is managed by your hosting panel, use that panel’s supported method.

A server host fingerprint identifies the server and is different from your generated public-key fingerprint. Compare the server fingerprint through a trusted channel before accepting it. Investigate a changed host-key warning.

Windows: the SSH client must be installed. If you want an agent, run these commands in an administrator PowerShell terminal:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Return to your normal user terminal to run ssh-add. The generated server install command is for Linux / Unix; Windows SSH servers have different authorized-key paths.

OpenSSH connection options Windows OpenSSH key and agent guide

Inspect an existing public key

Paste one OpenSSH .pub line. This checks its format and SHA256 fingerprint locally. Private keys are rejected. Ed25519, RSA and uncompressed ECDSA P-256/P-384/P-521 are supported.

A format check does not prove ownership, a matching private key, or server trust. Certificates, hardware security-key formats, authorized_keys options and compressed ECDSA points are outside this inspector. Your text stays in page memory and is not sent to an API or stored in browser storage.

Understand the result

The SHA256 fingerprint identifies the public wire key and lets you compare copies. The local self-check signs and verifies a fixed test message; it does not connect to a server or prove that a remote host is trusted. RSA keys use the ssh-rsa key format and support modern RSA SHA-2 signatures; this does not enable old SHA-1 signatures.

Limits and privacy

Generation and export use Web Crypto in a supported browser over HTTPS or localhost. Ed25519 support can vary; unsupported algorithms fail without a fallback. Private downloads are unencrypted because this tool does not add passphrases. Keys are held in page memory, never sent to an API, stored in browser storage, or placed in a URL. Clear removes page references and visible material; JavaScript cannot guarantee erasure of all browser memory, clipboard contents, or files you already downloaded.

OpenSSH key formats and specifications