SSH Key Generator

What is an SSH key pair?

An SSH key pair is two matching files: a private key you keep, such as ~/.ssh/id_ed25519, and a public key, id_ed25519.pub, that you copy onto every server you want to log in to. The server proves you hold the private key by having you sign a challenge with it, so no password crosses the network and nothing on the server can be used to log in as you.

This generator makes the pair with the Web Crypto API built into your browser, then writes both files in exactly the format ssh-keygen uses, so OpenSSH, Git, VS Code and every other SSH client read them as they are.

How the files are written

• The private key is an openssh-key-v1 file, the format OpenSSH has used by default since version 7.8 (described in OpenSSH's PROTOCOL.key). It starts with -----BEGIN OPENSSH PRIVATE KEY-----.
• With a passphrase, the private part is encrypted the way ssh-keygen does it: the passphrase and a random 16-byte salt go through bcrypt_pbkdf with 24 rounds (what ssh-keygen in OpenSSH 10 uses; older releases used 16), and the result keys aes256-ctr. Without a passphrase the key is stored in the clear, like ssh-keygen -N ''.
• The public key is one line: the key type, the key in base64 (RFC 4253 section 6.6) and your comment.
• The fingerprint is the SHA-256 of the public key in unpadded base64, printed as ssh-keygen -l prints it.

Which key type to choose

Ed25519 needs Web Crypto support in the browser (Chrome 137, Firefox 129 or Safari 17 and later). If yours lacks it, the generator says so and offers RSA. RSA 4096 can take several seconds, because finding two 2048-bit primes is slow.

A worked example

Generate an Ed25519 key with the comment alice@laptop, download both files, then on macOS or Linux:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
mv ~/Downloads/id_ed25519 ~/Downloads/id_ed25519.pub ~/.ssh/
chmod 600 ~/.ssh/id_ed25519
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@203.0.113.10
ssh -i ~/.ssh/id_ed25519 deploy@203.0.113.10

ssh-copy-id asks for the account's password once and appends the public key to ~/.ssh/authorized_keys on the server. Check the result locally with ssh-keygen -l -f ~/.ssh/id_ed25519.pub; it prints the same fingerprint the page shows. On Windows the page writes the PowerShell equivalent, since Windows has no ssh-copy-id.

To stop typing the address and key every time, add a block to ~/.ssh/config (the page writes it for you; the SSH config generator builds a whole file):

Host web
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Common errors and how to fix them

• "WARNING: UNPROTECTED PRIVATE KEY FILE!" The key is readable by other users. Run chmod 600 ~/.ssh/id_ed25519; on Windows, remove inherited permissions with icacls as the page shows.
• "Permission denied (publickey)" The server does not have the public key, or cannot read it. On the server, ~/.ssh must be 700 and authorized_keys 600, both owned by the user. Run ssh -v to see which keys the client offered.
• "Load key: invalid format" The file was changed on the way, often by a browser adding .txt or an editor converting line endings. Download it again and keep the name exactly id_ed25519.
• "incorrect passphrase supplied to decrypt private key" The passphrase differs from the one you typed here. Remove or change it with ssh-keygen -p -f ~/.ssh/id_ed25519.

Is it safe to make a key in a browser?

The key comes from crypto.subtle.generateKey, which draws on the same cryptographically secure random source the browser uses for TLS, and the files are assembled in this page's script. Nothing is uploaded, but the private key is shown on screen and passes through the clipboard if you copy it. For a key that guards production servers, generating it with ssh-keygen -t ed25519 on the machine that will use it is just as easy and never puts the key in a browser at all.

Using the key with Shipown

When you add a server in Shipown, you point it at a private key file such as this one, with its passphrase if it has one. The app's main process reads the key, and with credential settings you choose whether the passphrase is kept for the session or saved with OS encryption. To give a teammate or a CI job its own key on a server, deploy users creates a non-root account and adds their public key; check the result with the authorized_keys analyzer.