Pick the algorithm
Ed25519 is the default: fast, compact and widely supported. Take RSA-3072+ or ECDSA only where Ed25519 is unavailable.
Free tools · SSH keys
Fresh SSH keys, made on your device.
Generate an Ed25519, RSA or ECDSA keypair with your browser's audited crypto — emitted as OpenSSH, never uploaded.
New key
Generate locally.
Fresh randomness from your browser, emitted as OpenSSH. DSA, Ed448 and SSH-1 cannot be generated here — take Ed25519 or RSA instead. Need PuTTY format? Use the PPK generator.
Key type
Randomness (move your mouse over the pad, like PuTTYgen)
0%
Your browser's secure generator creates the key itself; your movements additionally seed salts and padding. Nothing leaves your device.
How it works
Three steps, all on your device.
The browser does what ssh-keygen does on your own machine: fresh randomness in, standard key files out.
Add randomness
Move your mouse over the pad, like PuTTYgen. The keypair itself always comes from your browser's audited secure generator.
Save and install
Copy the OpenSSH private key or download it, protect ~/.ssh with chmod 700 and the key with chmod 600, then append the public line to authorized_keys.
Questions
Generating SSH keys, answered.
If you manage servers by hand, see the engineering services behind this tools series.
Is my generated key uploaded anywhere?
No. The keypair is created inside your browser with WebCrypto and never leaves your device — the page makes no network requests with your key. You can verify this in your browser's developer tools or disconnect from the network after the page loads.
Which key types can I generate?
Ed25519 (recommended), RSA with 2048, 3072 or 4096 bits, and ECDSA with the NIST P-256, P-384 or P-521 curves. DSA, Ed448 and SSH-1 have no browser generator and are deprecated anyway — take Ed25519 or RSA instead.
Should I protect the key with a passphrase?
Yes for anything that matters. A passphrase encrypts the private key file (OpenSSH bcrypt format, the same ssh-keygen produces), so a stolen file alone is useless. Leave it empty only for automation keys that must load unattended — and guard those files instead.
Does waving the mouse really make my key stronger?
Mostly it makes generation yours: the keypair itself always comes from your browser's audited secure generator, which needs no help. Your movements are hashed and additionally mixed into salts and check values. It is the same ritual PuTTYgen uses, stated honestly — skip it any time and the key is just as strong.
I need PuTTY (.ppk) format instead. What now?
Use the PPK generator for fresh PuTTY files, or drop an existing OpenSSH key into the format converter to re-wrap it as PPK. Conversion only changes the container — the key stays identical.
How do I install the key on a server?
Append the public key line to ~/.ssh/authorized_keys for the right user, set chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys, then connect with ssh -i <private-key-file> user@host. Keep the private key secret; only the public line ever goes on a server.