Is it safe to generate SSH keys in a browser?

For testing and learning it is acceptable. The key material is generated entirely inside your browser using the Web Crypto API (crypto.subtle) and is never transmitted to any server. For production use — especially for keys that protect important infrastructure — generate keys locally with ssh-keygen so you have full control over the entropy source and key storage.

What is the difference between Ed25519 and RSA?

Ed25519 uses elliptic-curve cryptography and produces smaller keys (just 68 bytes for the public key) while being faster to generate and generally considered more secure than RSA-2048. RSA is the older standard and is required by some legacy systems. RSA-4096 offers a larger security margin than RSA-2048 at the cost of slower generation and larger key files.

What does the comment field do?

The comment is appended to the end of the public key line (e.g., ssh-ed25519 AAAA... user@host). It is purely informational — SSH ignores it during authentication — but it helps you identify which key belongs to whom when managing many keys in an authorized_keys file.

Does the passphrase protect the private key?

Yes. When a passphrase is provided the private key is encrypted using AES-256-CBC (the standard OpenSSH encryption for PEM keys) before being displayed. You must enter the passphrase every time the key is loaded by your SSH client. Note: because this tool uses the browser Web Crypto API, passphrase-protected private keys are formatted in the traditional PEM encrypted format.

SSH Key Pair Generator

Name: SSH Key Pair Generator
Availability: InStock
Author: Nham Vu

Choose an algorithm, enter a comment, optionally add a passphrase, then click Generate. Copy or download the public and private keys.

Key Settings

Algorithm

Comment

Appended to the public key line for identification.

Passphrase (optional)

Use ssh-keygen on your own machine for production keys; this tool is for testing and learning.

Public Key

One line — paste into ~/.ssh/authorized_keys

Private Key

OpenSSH PEM format — keep this secret

Summary

Choose an algorithm, enter a comment, optionally add a passphrase, then click Generate. Copy or download the public and private keys.

How it works

Select an algorithm from the dropdown: Ed25519 (recommended and fastest), RSA-2048, or RSA-4096.
Enter a comment in the Comment field — this appears at the end of the public key and identifies the key (e.g., user@host).
Optionally type a passphrase. The strength meter will show how strong it is. Leave it blank for an unencrypted key.
Click the Generate Key Pair button and wait — RSA-4096 may take a few seconds.
Copy the Public Key (one line, for ~/.ssh/authorized_keys) and the Private Key (multi-line PEM block) using the Copy buttons, or download them as files.

Use cases

Quickly generate a throw-away Ed25519 key pair for testing SSH access to a new server.
Produce an RSA-4096 key pair when a legacy system requires RSA rather than Ed25519.
Demonstrate SSH key-pair concepts and OpenSSH key formats in a learning or classroom environment.
Generate a key pair for a CI/CD pipeline proof-of-concept without installing extra tools.

Frequently Asked Questions

Last updated: 2026-06-09 · Reviewed by Nham Vu