Security Tools

SSH Key Generator & Fingerprint Tool

Create Ed25519 or RSA key pairs in OpenSSH format, and calculate the SHA256 and legacy MD5 fingerprints, key type, size and comment of public keys from authorized_keys or known_hosts.

Private by design: anything you enter is processed in your browser only. It is never uploaded to or logged on our servers. Keys are generated with your browser's Web Crypto API. Private keys are never included in share links; only public keys and settings are.

Treat browser-generated keys as test or throwaway keys.

The key is created locally and never leaves this page, but a web page is a less controlled environment than your terminal: browser extensions, a compromised device or clipboard managers can see it. For production servers, run ssh-keygen -t ed25519 on the machine that will use the key and protect it with a passphrase. Keys from this page are unencrypted; add a passphrase afterwards with ssh-keygen -p -f ~/.ssh/id_ed25519.

Key Type

Comment

Free text appended to the public key to identify it, usually user@host.

About SSH keys and fingerprints

SSH public key authentication uses a key pair: the private key stays on your computer (for example ~/.ssh/id_ed25519) and the public key (id_ed25519.pub) is added to ~/.ssh/authorized_keys on the server or to your GitHub/GitLab account. The public key line has three parts: the key type, the Base64 encoded key blob and an optional comment. Ed25519 keys are short, fast and the modern default; RSA keys of 3072 bits or more remain the most widely compatible choice for old servers and appliances.

A fingerprint is a short hash of the decoded public key blob, used to confirm you are talking to the right server or that the right key is installed. OpenSSH 6.8 and later show SHA256: followed by the unpadded Base64 SHA-256 digest; older tools and some cloud consoles show the legacy MD5 form as 16 colon-separated hex bytes. This tool computes both, exactly as ssh-keygen -l -f key.pub and ssh-keygen -l -E md5 -f key.pub do, so you can compare a key in authorized_keys with the fingerprint GitHub or your hosting provider displays.

The generator writes the private key in the openssh-key-v1 format (-----BEGIN OPENSSH PRIVATE KEY-----) that ssh-keygen itself produces, without a passphrase. Check a downloaded key with ssh-keygen -y -f id_ed25519, which prints the matching public key. Ed25519 generation needs a browser whose Web Crypto API supports Ed25519 (current Chrome, Edge, Firefox and Safari); RSA works everywhere Web Crypto does.

Browser-generated keys are convenient for test VMs, CI fixtures and learning, but for anything that guards production access, generate the key with ssh-keygen on the device that will use it and set a passphrase. Never share a private key or paste it into a website; if one leaks, remove its public key from every authorized_keys file and generate a new pair. Related tools: hash generator, Base64 encoder/decoder for inspecting key blobs, the secrets scrubber to redact keys from logs, and the password generator for strong passphrases.

Reference Guide

SSH key types:

Type string	Algorithm	Size	Notes
`ssh-ed25519`	Ed25519 (EdDSA)	256 bits	Recommended default; 68-character Base64 blob
`ssh-rsa`	RSA	2048–4096+ bits	Use 3072+ bits. The key type is fine; only SHA-1 signatures (also called ssh-rsa) are disabled by default since OpenSSH 8.8, and modern clients sign with rsa-sha2-256/512 automatically
`ecdsa-sha2-nistp256` / `384` / `521`	ECDSA	256 / 384 / 521 bits	NIST curves
`sk-ssh-ed25519@openssh.com`	Ed25519 on a FIDO2 security key	256 bits	Private key stays on the hardware token
`ssh-dss`	DSA	1024 bits	Obsolete; disabled by default since OpenSSH 7.0

Useful commands:

Task	Command
Generate an Ed25519 key	`ssh-keygen -t ed25519 -C "you@laptop"`
Generate an RSA key	`ssh-keygen -t rsa -b 4096 -C "you@laptop"`
SHA256 fingerprint	`ssh-keygen -lf ~/.ssh/id_ed25519.pub`
MD5 fingerprint	`ssh-keygen -E md5 -lf ~/.ssh/id_ed25519.pub`
Fingerprints of all authorized keys	`ssh-keygen -lf ~/.ssh/authorized_keys`
Public key from a private key	`ssh-keygen -y -f ~/.ssh/id_ed25519`
Add or change a passphrase	`ssh-keygen -p -f ~/.ssh/id_ed25519`
Install the key on a server	`ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host`
Fix permissions	`chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keys`

Public key blob encoding (RFC 4253 / RFC 8709): each field is a 4-byte big-endian length followed by the bytes.

Type	Fields in the blob
`ssh-ed25519`	string `"ssh-ed25519"`, string public key (32 bytes)
`ssh-rsa`	string `"ssh-rsa"`, mpint e, mpint n (a `00` byte is prepended when the top bit is set)

Example input

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID/LHH9uCzGyNTt/RX1Hq7WAN7P6hDMxgxNyyshZnzRu demo@toolbyte
→ 256 SHA256:Pjm4ImYGYZ6U4Q/xUpJoc3GkRGxnruVrtGC2ibGSpzw demo@toolbyte (ED25519)
→ 256 MD5:dc:5e:89:9c:85:7a:c3:95:c4:06:9d:06:01:d5:31:bc demo@toolbyte (ED25519)

This sample loads automatically when you open the tool. Use Load Sample to bring it back.

Frequently Asked Questions

Ed25519 keys are short, fast and secure, and are the default choice for modern OpenSSH. Use RSA with at least 3072 bits only when a server or device does not support Ed25519.

A fingerprint is a short hash of a public key, shown as SHA256:… by modern OpenSSH. Compare it with the value the server or a colleague gives you to confirm you have the right key.

The keys are generated locally with the Web Crypto API and never sent anywhere. For production servers, generating keys with ssh-keygen on your own machine is still the recommended practice.

Related Tools

All Security Tools →

Secrets & PII Scrubber

Mask API keys, tokens, passwords, emails, phone numbers, car...

Credit Card & IBAN Validator

Check credit card numbers with the Luhn algorithm and detect...

AWS IAM Policy Viewer & Analyzer

Visualize AWS IAM policy JSON as readable statements, see wh...

Blur Face in Image

Automatically detect and blur faces to protect privacy in im...

Free SEO Analyzer & Website Audit Tool

Comprehensive SEO analysis for any website. Check technical...

Free XML Sitemap Generator

Generate XML sitemaps for your website and submit to Google...