Softonic

SSH Key Generator

Step 1 / 2 Public key (authorized_keys format)
Next

Generate an RSA SSH keypair right in your browser. Choose the key size (2048, 3072 or 4096-bit) and an optional comment; the tool writes out the private key and a public key ready to drop into ~/.ssh/authorized_keys. Everything runs in your browser, so neither key ever leaves your device. For a modern Ed25519 key, or to protect the key with a passphrase, run ssh-keygen on your own machine.

How to generate a keypair

  1. 1

    Pick the key size

    RSA 3072-bit is the recommended default: strong and universally compatible. 2048-bit is faster and still widely accepted; 4096-bit is the most conservative but slower.

  2. 2

    Add a comment

    Usually `user@host` or a short descriptor. It is appended to the public key so you can identify it in `authorized_keys` files.

  3. 3

    Generate the keypair

    The keys are created in your browser and never uploaded. Larger key sizes take a little longer to compute.

  4. 4

    Copy or download

    Private key in PEM format (`-----BEGIN RSA PRIVATE KEY-----`) and public key on one line (`ssh-rsa AAAA...`). Keep the private key secret.

Choosing a key size

Key size Speed Security Use it when
RSA 2048 Fast Adequate (112-bit equivalent) You want the quickest generation
RSA 3072 Moderate Strong (128-bit equivalent) The recommended default for most uses
RSA 4096 Slower Very strong, overkill for most You want a conservative, long-lived key

This tool generates RSA keys, which every SSH server accepts. RSA 3072 already matches 128-bit symmetric strength, which is plenty for everyday use; 4096 is larger and slower to generate without being meaningfully safer.

Prefer a modern Ed25519 key? It is shorter and faster than RSA, but it is not produced here. Create one on your own machine with ssh-keygen -t ed25519.

What you get

The tool outputs two pieces of text, both generated in your browser:

  • Private key in PEM format, starting with -----BEGIN RSA PRIVATE KEY-----. Keep it secret and never share it. It is generated without a passphrase; to encrypt it, add one locally with ssh-keygen -p -f id_rsa.
  • Public key on a single line, in OpenSSH authorized_keys format:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQAB... user@laptop

The three fields are the algorithm name (ssh-rsa), the Base64-encoded key material, and your optional comment.

Key management tips

  • Keep the private key private. A plain-text private key is game over if it is stolen. Store it with strict permissions and add a passphrase for anything important.
  • Per-purpose keys. Use one key per service (GitHub, GitLab, production, staging) so a single leak has a limited blast radius.
  • Rotate on departure. When someone leaves, remove their public key from every authorized_keys file.
  • Never send the private key. Share only the public key. Tattoo this on your forehead.
  • Back up encrypted copies. Losing the only copy of a key can lock you out of every server that trusts it.

Where the public key goes

  • Linux/Unix: ~/.ssh/authorized_keys on the server, one key per line, mode 0600 for the file and 0700 for the directory.
  • GitHub/GitLab/Bitbucket: Account settings, SSH keys section.
  • AWS EC2: Imported keypair, tied to an instance at launch.
  • Azure/GCP: Project or instance SSH settings.

Frequently Asked Questions

If you trust the page (served over HTTPS, from a host you verify), yes. The keypair is computed in your browser and neither key is uploaded to any server. That said, running ssh-keygen on your own machine is still the gold standard because it avoids any browser-layer compromise.

No. This tool creates RSA keys only. For a modern Ed25519 key, run ssh-keygen -t ed25519 on your own machine; it is shorter and faster than RSA and supported by every current SSH server.

Not really. RSA 3072 is already equivalent to 128-bit symmetric strength, which is more than enough. 4096 is slower and larger without being meaningfully more secure, so 3072 is the recommended default.

Use ssh-copy-id user@host if you can still log in with a password. Otherwise, append the public key manually to ~/.ssh/authorized_keys on the server via your cloud console or another access method.

Related Tools

A1Z26 Cipher Encoder

Encode text using the A1Z26 cipher (A=1, B=2, ... Z=26) or decode a number sequence back to letters, with customizable separator.

Cipher Identifier

Paste ciphertext and the identifier suggests likely encoding/cipher schemes: Base64, hex, binary, Morse, Caesar or substitution, JWT and common hashes.

Atbash Cipher Encoder

Encode or decode text with the Atbash cipher, a Hebrew substitution that maps A-Z to Z-A. Same operation encrypts and decrypts.

Caesar Cipher Encoder

Encrypt and decrypt text using the Caesar cipher. Any shift 1-25, supports ROT13 as a special case, preserves punctuation and case.

Encryption Identifier

Paste a ciphertext or hash and the identifier suggests likely algorithms or encodings: MD5, SHA, bcrypt, AES, RSA, Base64 and more.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 hashes from text, with a copy-ready digest for checksums and comparisons.

Tool available in other languages