go-supertools
Security & Privacy Tools

SSH Key Generator

Generate an SSH key pair (Ed25519, RSA or ECDSA) in OpenSSH format, with an optional passphrase.

Runs in your browser Your input never leaves your device.

Keys are made in your browser and never sent anywhere. Even so, for keys that guard important servers the safest place to create them is your own computer with ssh-keygen, on a machine you trust. Use this tool for tests, learning and low-risk keys.

Report a problem with this tool

About this tool

Choose a key type, add a comment (usually your email or the name of the computer) and, if you like, a passphrase, then press Generate. You get the public key, a single line that you add to ~/.ssh/authorized_keys on a server or to your GitHub, GitLab or Bitbucket account, the private key in the OpenSSH format, and the SHA256 fingerprint that ssh and ssh-keygen print for the key. Ed25519 is the best choice today: small, fast and the default of current OpenSSH. RSA 3072 or 4096 works with very old servers. ECDSA P-256 is supported by OpenSSH and most services. A passphrase encrypts the private key file in the same way ssh-keygen does (bcrypt key derivation with 16 rounds and AES-256), so a stolen file is useless without it. The keys are made with your browser's own cryptography (WebCrypto) and the file formats are written by this page. We checked every key type, with and without a passphrase, using the real ssh-keygen: it derived the same public key from our private file, printed the same fingerprint, refused a wrong passphrase, and a signature made with our private key verified against our public key. Nothing is sent over the network. Even so, a private key that protects something important should be made on a computer you trust with ssh-keygen: a browser page is only as safe as the browser and its extensions. Keys are generated in your browser and never uploaded.

How to use it

  1. Choose the key type (Ed25519 unless you need to support old systems).
  2. Add a comment and, better, a passphrase.
  3. Press Generate, then download both files.
  4. Save the private key as ~/.ssh/id_ed25519 with chmod 600, and put the public key on the server or service.

Common problems

Ed25519 is not offered or fails
Your browser may be too old to create Ed25519 keys (it needs Chrome 137, Firefox 129 or Safari 17). Update it, or use RSA 3072 or ECDSA.
ssh says the permissions are too open
Run chmod 600 on the private key file, and chmod 700 on the .ssh folder.
I forgot the passphrase
It cannot be recovered. Generate a new key pair and replace the public key where you used the old one.

Related Tools

SSH Key & authorized_keys Analyzer

Read SSH public keys, certificates and authorized_keys lines: type, size, fingerprints, certificate details and a numbered security ruleset. Private keys are refused.

sshd_config & ssh_config Analyzer

Check an sshd_config or ssh_config for risky settings: root and password login, weak ciphers, forwarding, host key checking. Shows the effective values with Match and Host blocks applied.

SSH Config Generator

Generate an OpenSSH client Host block for your ~/.ssh/config.

Key & CSR Generator

Generate an RSA, ECDSA or Ed25519 key pair and a certificate signing request (CSR) in your browser.

Password Generator

Create secure passwords

.env File Analyzer

Check a .env file for leaked secrets, keys that end up in the browser bundle, debug flags, weak values and parsing traps. Values stay masked.

AES-256 Encryption/Decryption

Encrypt and decrypt text with AES-256-GCM and a passphrase, entirely in your browser.

ASN.1 Decoder

Decode DER data (certificates, keys, signatures) into its element tree.