# SSH Key Pair Generator

Generate an SSH key pair (Ed25519 recommended, RSA 4096, or ECDSA P-256) with an OpenSSH-format public key ready for ~/.ssh/authorized_keys, a SHA256 fingerprint, and a PEM private key. Optional passphrase encryption. Runs locally.

> Canonical page: https://elysiatools.com/en/tools/ssh-key-generator

- **Category:** Security

- **Keywords:** ssh, key, ed25519, rsa, ecdsa, authorized_keys, openssh, keypair, ssh-keygen, fingerprint

## Overview

Generates an SSH key pair and formats the public key in OpenSSH one-line format.

- **Algorithm**:
  - **Ed25519** (recommended) — modern, small, fast, the default in OpenSSH since 2015. 256-bit security.
  - **RSA 4096** — large but widely compatible with very old SSH servers. Use only if Ed25519 isn't supported.
  - **ECDSA P-256** — compact alternative; less common than Ed25519.
- **Comment**: appended to the public key (e.g. `alice@laptop`). Helps identify the key in authorized_keys.
- **Passphrase**: if provided, the private key is encrypted (AES-256-CBC, PKCS#8).

Outputs:
- Public key in OpenSSH format (`ssh-ed25519 AAAA... comment`) — paste directly into `~/.ssh/authorized_keys`.
- SHA256 fingerprint (`SHA256:...`) for verifying the key over an insecure channel.
- Private key in PKCS#8 PEM. (Node cannot emit the OpenSSH private-key container natively; convert with `ssh-keygen -p` if you need the `BEGIN OPENSSH PRIVATE KEY` format.)

Everything runs locally; keys never leave the request.

## Inputs

- **Algorithm** (select)
- **Comment (e.g. user@host)** (text): alice@laptop
- **Passphrase (optional, encrypts private key)** (text): Leave empty for an unencrypted key…

## When to use

- When you need to set up secure, passwordless SSH access to a remote server or cloud instance.
- When you need to generate a modern Ed25519 or legacy RSA 4096 key pair quickly without using the command line.
- When you want to generate keys locally in the browser to ensure your private keys never traverse the network.

## How it works

- Select your preferred cryptographic algorithm, such as Ed25519, RSA 4096, or ECDSA P-256.
- Enter an optional comment to identify the key and a passphrase to encrypt the private key using AES-256-CBC.
- Click generate to run the cryptographic operations locally in your browser.
- Copy the resulting OpenSSH public key, SHA256 fingerprint, and PKCS#8 PEM private key.

## Use cases

- Provisioning a new Linux cloud server with a secure Ed25519 public key for SSH authentication.
- Generating a legacy RSA 4096 key pair to connect to older network hardware or legacy servers.
- Creating a passphrase-encrypted SSH key pair for secure deployment pipelines or automated scripts.

## Frequently asked questions

### Are my generated keys sent to a server?

No. All key generation runs locally in your browser and keys are never transmitted over the network.

### Which algorithm should I choose?

Ed25519 is recommended for modern systems due to its speed and security, while RSA 4096 is best for legacy compatibility.

### How do I use the public key on my server?

Copy the generated OpenSSH public key string and append it to the ~/.ssh/authorized_keys file on your remote server.

### Why is the private key in PKCS#8 PEM format?

Browser-based generation outputs standard PKCS#8 PEM. You can convert it to the OpenSSH private key format using ssh-keygen -p if required.

### Can I secure my private key with a password?

Yes. Entering a passphrase encrypts the private key using AES-256-CBC before outputting it.

## Related tools

- [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.
- [HMAC Generator & Verifier](https://elysiatools.com/en/tools/hmac-generator-verifier): Compute an HMAC message-authentication signature over a message + shared secret using SHA-1/SHA-2/SHA-3/BLAKE2, or verify an incoming signature against the secret — with webhook presets for Stripe / Slack / GitHub and constant-time comparison
- [Markdown Table Generator](https://elysiatools.com/en/tools/markdown-table-generator): Generate formatted Markdown tables from CSV, JSON, or array data with alignment, header styles, width control, and merge hints
- [TOTP / HOTP Offline Code Generator](https://elysiatools.com/en/tools/totp-hotp-offline-generator): Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy
- [Argon2 Password Hash Generator](https://elysiatools.com/en/tools/argon2-password-hash-generator): Generate Argon2id password hashes with tunable memory, iterations, parallelism, salt length, and PHC output
- [BIP39 Mnemonic Phrase Generator](https://elysiatools.com/en/tools/mnemonic-bip39-generator): Generate or validate 12 to 24 word BIP39 mnemonic phrases with entropy and PBKDF2-HMAC-SHA512 seed output
- [Data Column Extractor](https://elysiatools.com/en/tools/data-column-extractor): Extract specific columns from tabular data with support for various formats and flexible column selection
- [SP 800-56C HKDF Extract and Expand Walkthrough](https://elysiatools.com/en/tools/sp800-56c-hkdf-extract-and-expand-walkthrough): Show each HMAC step of HKDF Extract+Expand for protocol key derivation, including PRK, T(n), and OKM.

## Samples

- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Web Image Processing Rust Samples](https://elysiatools.com/en/samples/web-image-processing-rust): Web Rust image processing examples including image read/save, scaling, and format conversion

## Related content

- [Text Redaction, Highlighting, and Presentation Formatting Tools](https://elysiatools.com/en/hubs/text-format): Compare tools for masking sensitive text, finding PII, normalizing phone numbers, highlighting phrases, centering text, and formatting diffs in one hub.
- [JSON Formatting, Diff, and Normalization Tools](https://elysiatools.com/en/hubs/json-format): Compare JSON formatting, diffing, log review, config comparison, and data-normalization tools in one hub for readable and reviewable JSON workflows.
- [Code and Markup Minify, Beautify, and Format Tools](https://elysiatools.com/en/hubs/code-minify-beautify-format-tools): Minify and beautify CSS, HTML, JavaScript, JSON, SQL, XML, YAML, TOML, SVG, and VBA, lint Markdown and email HTML, and format code across languages in one hub for production and review workflows.