Is it safe to generate SSH keys in a browser?

For testing and learning it is acceptable. The key material is generated entirely inside your browser using the Web Crypto API (crypto.subtle) and is never transmitted to any server. For production use — especially for keys that protect important infrastructure — generate keys locally with ssh-keygen so you have full control over the entropy source and key storage.

What is the difference between Ed25519 and RSA?

Ed25519 uses elliptic-curve cryptography and produces smaller keys (just 68 bytes for the public key) while being faster to generate and generally considered more secure than RSA-2048. RSA is the older standard and is required by some legacy systems. RSA-4096 offers a larger security margin than RSA-2048 at the cost of slower generation and larger key files.

What does the comment field do?

The comment is appended to the end of the public key line (e.g., ssh-ed25519 AAAA... user@host). It is purely informational — SSH ignores it during authentication — but it helps you identify which key belongs to whom when managing many keys in an authorized_keys file.

Is the generated private key protected by a passphrase?

No. This browser tool exports an unencrypted private key. Store it securely, or use ssh-keygen -p on a trusted local machine to add passphrase protection before using it.

SSH Key Pair Generator

Choose an algorithm and optional public-key comment, then generate and copy or download an unencrypted SSH key pair in your browser.

Key Settings

Algorithm

Comment

Appended to the public key line for identification.

Generated private keys are unencrypted. Add a passphrase afterward with ssh-keygen -p on a trusted local machine.

Use ssh-keygen on your own machine for production keys; this tool is for testing and learning.

Public Key

One line — paste into ~/.ssh/authorized_keys

Private Key

OpenSSH PEM format — keep this secret

Summary

Choose an algorithm and optional public-key comment, then generate and copy or download an unencrypted SSH key pair in your browser.

How it works

Select an algorithm from the dropdown: Ed25519 (recommended and fastest), RSA-2048, or RSA-4096.
Enter a comment in the Comment field — this appears at the end of the public key and identifies the key (e.g., user@host).
Click the Generate Key Pair button and wait — RSA-4096 may take a few seconds.
Copy the Public Key (one line, for ~/.ssh/authorized_keys) and the Private Key (multi-line PEM block) using the Copy buttons, or download them as files.
Protect the downloaded private key with ssh-keygen if passphrase encryption is required.

Use cases

Quickly generate a throw-away Ed25519 key pair for testing SSH access to a new server.
Produce an RSA-4096 key pair when a legacy system requires RSA rather than Ed25519.
Demonstrate SSH key-pair concepts and OpenSSH key formats in a learning or classroom environment.
Generate a key pair for a CI/CD pipeline proof-of-concept without installing extra tools.

Frequently Asked Questions

Last updated: 2026-09-22 · Reviewed by Nham Vu