Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.
Pick the key type — Ed25519 unless something old forces RSA — and optionally set the comment (it only labels the public key).
Click "Generate keypair".
Save the private key as ~/.ssh/id_ed25519 (or id_rsa) and run chmod 600 on it.
Paste the public key line into ~/.ssh/authorized_keys on the server, or into GitHub/GitLab → SSH keys. The SHA256 fingerprint chip lets you verify it matches later.
Every online SSH key generator has the same disqualifying flaw: the private key is born on someone else’s server. This one uses your browser’s WebCrypto engine, so the keypair is generated on your device and the private key never exists anywhere else — the page just formats what WebCrypto produced into the same artifacts ssh-keygen writes.
Ed25519 is the right choice for anything modern (GitHub, GitLab, current OpenSSH): tiny keys, fast, no parameter pitfalls — and it downloads in the native openssh-key-v1 container. RSA 4096/2048 remains for legacy systems that predate Ed25519 support.
100% private“The private key is generated by WebCrypto in this tab and never transmitted — generate it with the network disconnected if you like. Nothing is stored; closing the page erases everything you did not download.”
Encrypting an OpenSSH private key uses bcrypt rounds that are painfully slow in a browser tab, so this tool outputs the key unencrypted — exactly like ssh-keygen -N "". To add a passphrase, run ssh-keygen -p -f id_ed25519 on your machine afterwards; the key itself is identical.
Ed25519, unless you must talk to something that predates OpenSSH 6.5 (2014) or a rare appliance without Ed25519 support. The keys are 68 characters instead of 700+, faster to use, and immune to the parameter mistakes RSA allows. GitHub and GitLab both recommend it.
Yes — both draw from the operating system’s cryptographic random source. WebCrypto’s generator is the same hardened code path the browser uses for TLS itself, and the output container is byte-compatible with what ssh-keygen writes.