./prontouso.com

SECURITY

SSH Key Generator

Generate an Ed25519, RSA, or ECDSA SSH key pair in the browser, get the OpenSSH public key and SHA-256/MD5 fingerprints, inspect an existing public key, or build an equivalent ssh-keygen command. Runs locally, no upload.

Tool statusReady to use in your browser
AvailableIn Testing
!
For highly sensitive production access, prefer generating the key in a terminal or on dedicated hardware.

"Generated locally" reduces network exposure, but doesn't make a page immune to a compromised browser, a malicious extension, or altered JavaScript. This tool also offers a ssh-keygen command builder for exactly that case.

prontouso://security/ssh-key-generator
LocalOpenSSH

Configure the key

Ed25519 is the default for a new key; use RSA when you need compatibility.

Options
Algorithm options

Ed25519 has no configurable size. The browser will confirm support when you generate.

Where do you plan to use this?

This only changes the instructions after generation, not the key.

Private key protection

This tool generates OpenSSH without a passphrase. For a protected key, generate it in a terminal or add a passphrase afterward with `ssh-keygen -p`.

Why not ask for a passphrase here? OpenSSH's encrypted private key format uses a specific KDF; implementing that correctly needs more than the Web Crypto API offers natively. Rather than pretend a generic encrypted export is the same as a protected OpenSSH identity, this tool is upfront about the limitation.

● No history · no upload · key extractable only for export

Key pair

Copy the public key. Treat the private one as a secret.

Options
SSH

No key generated yet

Choose the algorithm and generate the pair. The browser will self-test the signature before unlocking downloads.

How it works

  1. Enter your input

    Fill in the values, paste your text, or upload the file this tool works with.

  2. See results instantly

    Most tools update live as you type; a few use a single button. Either way, the result appears right on this page.

  3. Use your results

    Copy, download, or share what the tool produces — you're always in control of the output.

100% Private & Secure — Runs locally in your browser. This tool does not upload your input.

This tool is still being fine-tuned, so you may run into the odd error. Spotted one? Let us know so we can fix it.

What is SSH Key Generator?

ProntoUso's SSH Key Generator creates a real SSH key pair using the Web Crypto API, encodes it in the same OpenSSH format ssh-keygen produces, and signs a test payload with the new key before showing any result — all without the key material leaving your device.

ENTENDA A FERRAMENTA

How to generate an SSH key pair (Ed25519, RSA, ECDSA)

Generate an Ed25519, RSA, or ECDSA SSH key pair in the browser, get the OpenSSH public key line, check SHA-256/MD5 fingerprints, inspect an existing public key, or build the equivalent ssh-keygen command to run locally instead.

Choosing an algorithm

Ed25519 is the recommended default for a new key: it's compact, fast, and supported by every current SSH client and server. RSA (2048, 3072, or 4096 bits) exists for compatibility with older systems that don't support Ed25519 — 4096 bits is the simplest safe choice, 3072 matches OpenSSH's current default, and 2048 is a legacy floor. ECDSA (P-256 or P-384) covers environments that specifically require it.

What actually gets generated

The key pair is created with `crypto.subtle.generateKey`, then encoded by hand into the exact wire formats ssh-keygen uses: the OpenSSH public key line (`ssh-ed25519 AAAA... comment`), the unencrypted `openssh-key-v1` private key container, and a PKCS#8 PEM export for other cryptographic tooling. Before any of it is shown, the tool signs a random payload with the private key and verifies it with the public key — if that self-test fails, nothing is displayed.

Why there's no passphrase option

OpenSSH's encrypted private key format uses a specific key-derivation function (bcrypt_pbkdf) that needs more than what the Web Crypto API provides out of the box. Rather than encrypt the key with something that only resembles OpenSSH's real scheme, this tool generates an unencrypted private key and says so plainly — add a passphrase afterward with `ssh-keygen -p`, or generate the key in a terminal from the start if you need one immediately.

Fingerprints, and why they don't change with the comment

The SHA-256 and MD5 fingerprints are computed over the public key's binary blob — the same bytes `ssh-keygen -lf` hashes — not over the full text line. That's why adding or editing the comment at the end of a public key never changes its fingerprint: the comment isn't part of what's hashed.

Inspecting an existing public key

The inspector accepts a single OpenSSH public key line, decodes its base64 blob, cross-checks the type declared inside the blob against the type prefix in the text, and reports the key size or curve, comment, and both fingerprints. It refuses any input containing "PRIVATE KEY" — there's no legitimate reason to paste private key material into a key inspector.

Generating the key in a terminal instead

The command builder produces the exact `ssh-keygen` invocation for the algorithm, comment, and filename you choose — useful when you'd rather the private key never be created inside a browser tab at all. ssh-keygen prompts for the passphrase itself, directly in the terminal; it never passes through this page.

Generated locally, but read this before production use

Key generation, encoding, and fingerprinting run entirely in your browser via the Web Crypto API — nothing is uploaded, and the private key is hidden by default until you choose to reveal it. That said, local generation reduces network exposure, not every risk: a compromised browser, a malicious extension, or tampered JavaScript could still see key material during generation. For a highly privileged production identity, prefer running ssh-keygen locally or a hardware-backed key.

Frequently Asked Questions

Which SSH key should I generate for GitHub or GitLab?

Ed25519, if your client and the account you're adding it to both support it — nearly all current setups do. RSA 4096 remains available for older systems that require RSA specifically.

What do I do with the public key?

Add it to your Git provider's SSH key settings, or append it to a server's `~/.ssh/authorized_keys` file. The public key is meant to be shared; the private key is not.

Why are the SHA-256 and MD5 fingerprints different?

They're the same public key blob hashed with two different algorithms. OpenSSH shows SHA-256 by default today; MD5 sticks around for comparing against older tooling or documentation that still prints it.

Is it safe to generate an SSH key in a browser?

The key material can be created without leaving your device, which is meaningfully better than a form that submits it to a server. It still depends on the integrity of the page, browser, and any installed extensions, though — for a highly privileged production identity, generating locally with ssh-keygen or using a hardware-backed key is the safer choice.

Why doesn't the generated private key have a passphrase?

OpenSSH's passphrase-encrypted private key format relies on a specific key-derivation function that the Web Crypto API doesn't provide, and this tool won't fake that protection with something else. Add a passphrase afterward with `ssh-keygen -p -f <file>`, or generate the key with ssh-keygen from the start if you need a passphrase immediately.

Can I paste a private key into the inspector to check it?

No — the inspector only accepts a public key line and rejects anything containing "PRIVATE KEY" text. Checking a key's type, size, or fingerprint never requires the private half.

What does the self-test after generation actually check?

Right after the key pair is created, the tool signs a random value with the new private key and verifies that signature with the matching public key. If that round trip fails for any reason, the tool shows an error instead of a key you can't actually trust.

Related Tools