fjordtools

fjordtools / Security / Key Generator

Key Generator

Generate an Ed25519, ECDSA or RSA key pair in your browser: OpenSSH, PEM and JWK files with fingerprints. Keys never leave this tab and are not stored.

Fact

Keys are made in this tab with your browser's WebCrypto. Nothing is sent or saved, and the page makes no requests after it loads (check it yourself). Fine for development, tests and throwaway servers. Make a production key on the machine that will use it.

New key pair

The comment is written into both files so you can tell keys apart. It is not secret.

The same key on your own machine
ssh-keygen -t ed25519

About Key Generator

How do I generate an SSH key and use it?

Pick Ed25519, add a comment such as you@laptop and press Generate. Download id_ed25519 and id_ed25519.pub. The private file stays on your machine. The one-line public key goes on every server or service you want to log in to. Ed25519 keys are short, fast and the default choice today.

Put the files in ~/.ssh, lock the private one down (ssh refuses a key that other users can read), copy the public line to the server and test the login:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
mv ~/Downloads/id_ed25519* ~/.ssh/
chmod 600 ~/.ssh/id_ed25519
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host
ssh -i ~/.ssh/id_ed25519 user@host

Without ssh-copy-id, paste the line from the Public key box at the end of ~/.ssh/authorized_keys on the server. GitHub and GitLab take the same line under SSH keys in your settings. To check a key you already have, use the Key Inspector.

How do I generate an RSA or ECDSA key pair as PEM?

Choose RSA (3072 bits is a good default, and the one ssh-keygen uses) or ECDSA, press Generate and open the PEM tab. The private key is PKCS#8 (BEGIN PRIVATE KEY) and the public key is SPKI (BEGIN PUBLIC KEY), the formats OpenSSL 3, Node and most libraries read. PKCS#1 and SEC1 are there for older software.

The OpenSSL equivalent gives the same two files:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem

The SSH tab holds the OpenSSH private file, which Node's createPrivateKey cannot read (error:1E08010C:DECODER routines::unsupported); use the PEM tab for code. The JWK tab gives both keys as JSON for a JWKS, and the JWT decoder shows which kid a token expects.

Is a key made in the browser safe, and how do I add a passphrase?

The key is made by your browser's WebCrypto, stays in this tab and is gone when you close it. Nothing is sent or stored, and the note at the top of the page links to a way to check that yourself. Use it for development, tests, throwaway servers and learning. A production or long-lived key should be generated on the machine that will use it: ssh-keygen -t ed25519.

This page does not set a passphrase. Add one on your own machine, to the OpenSSH file or to the PEM file:

ssh-keygen -p -f ~/.ssh/id_ed25519
openssl pkcs8 -topk8 -v2 aes-256-cbc -in private.pem -out private-encrypted.pem

Each command asks for the new passphrase twice. Need a fresh secret instead of a key? Use the password generator.

Related tools