RSA and Ed25519 Key Pair Generator

Public-key cryptography needs a pair of keys: a private one you keep secret and a public one you hand out. SSH logins, code signing, TLS certificates, JWT signatures and Git commit signing all start from such a pair. This page creates one in your browser, with the standard random generator your browser already trusts, and gives you the files in the formats other software expects.

Ed25519 or RSA

Ed25519 is an elliptic-curve signature scheme with 256-bit keys. Its keys and signatures are small, it is fast to generate and use, and it has fewer ways to be misused than RSA, so it is the usual default for SSH and signing today. RSA is older and works nearly everywhere. If you need it, choose 3072 bits or more: 2048 is the minimum accepted by current guidance, and 4096 takes noticeably longer to generate, especially on a phone. DSA and small RSA keys are obsolete.

What you get

The Ed25519 sample on the page produces six items. The OpenSSH private key starts with -----BEGIN OPENSSH PRIVATE KEY-----. The OpenSSH public key is one line beginning ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA and ending with your comment, which defaults to [email protected]. The same key is also available as a PKCS#8 private key (a BEGIN PRIVATE KEY block) and a SubjectPublicKeyInfo public key (BEGIN PUBLIC KEY), which OpenSSL, Node, Java and most libraries read. Two fingerprints let you identify the key: the SSH one, SHA256: followed by Base64, and the JWK thumbprint of RFC 7638.

Using the files

For SSH, save the private key as id_ed25519 and run chmod 600 on it; OpenSSH refuses to use a private key that other users can read. Add the public key line to the server’s authorized_keys, or to GitHub, GitLab or any host’s key settings. Compare the SHA256 fingerprint the host shows with the one on this page to confirm you added the right key. For signing with libraries, use the PEM forms.

Keys made in a browser

The keys never leave the page: they are not stored, logged or sent. Even so, any key that has been displayed on screen, in a clipboard or in a downloads folder has had more exposure than one generated directly on its own machine with ssh-keygen -t ed25519. Treat browser-made keys as suitable for tests, demos, learning and low-risk accounts, and make long-lived identities locally.

Edge cases

RSA generation with 4096 bits can take several seconds and may freeze a slow device briefly. Ed25519 needs a recent browser (Chrome 137 or later, Firefox 129 or later, Safari 17 or later); older ones show an error and RSA still works. The comment is only a label and is not part of the cryptographic key.

Limits

The page does not encrypt private keys, create certificates or sign anything. It cannot import an existing key for modification; use the converter or fingerprint tools for that.

Related tools

• SSH Key Fingerprint Calculator checks fingerprints of existing public keys.
• JWK to PEM Converter converts keys between JSON and PEM.
• SSH Config Generator writes the client configuration that uses the key.
• ASN.1 Decoder shows the structure inside the PEM files.