MyDevTools
EN

OpenSSH Keys

Generate Ed25519, ECDSA or RSA SSH key pairs, optionally passphrase-protected, and convert between OpenSSH, PKCS#8 and SPKI PEM — in your browser.

Your inputs and files stay in your browser

Generate

Import

Paste an OpenSSH, SPKI or PKCS#8 key, open a key file or drop it here.

Supports OpenSSH public/private and PKCS#8 PEM files.

Generate a key pair or import a key — the public key appears here.

The private key appears here after generating, or when you import a private key.

On this page

OpenSSH Keys generates SSH key pairs (Ed25519, ECDSA P-256/P-384, RSA 3072/4096) and converts keys between OpenSSH, PKCS#8 and SPKI PEM formats. Keys are created and converted in your browser; the private key is never sent anywhere.

Detailed Functionality

Generation produces an OpenSSH private key (-----BEGIN OPENSSH PRIVATE KEY-----) and the matching public line (ssh-ed25519 AAAA…) ready for authorized_keys. With a passphrase, the private key is encrypted the way ssh-keygen does it: bcrypt-pbkdf with 16 rounds and aes256-ctr. The passphrase is used exactly as typed, spaces included. Key generation runs in a Web Worker: Ed25519 and ECDSA take milliseconds, RSA 4096 can take from several seconds to about a minute; meanwhile the page stays usable, shows the elapsed time and offers Cancel.

Import accepts a pasted key or a key file (drag and drop works): an OpenSSH public line (ssh-ed25519, ecdsa-sha2-nistp256/384, ssh-rsa), an OpenSSH private key, an SPKI PUBLIC KEY PEM or a PKCS#8 PRIVATE KEY / ENCRYPTED PRIVATE KEY PEM. For a private key it derives the public line; for a public key it shows the algorithm and comment. Convert turns an OpenSSH private key into PKCS#8, an OpenSSH public line into SPKI PEM and back, and PKCS#8 into OpenSSH.

Results can be copied or downloaded as id_key / id_key.pub (generated) or imported.key / imported.pub (imported). Warnings point out weak choices, such as RSA keys shorter than 3072 bits. Keys produced by earlier versions of this tool, which trimmed passphrases, still open: if the typed passphrase is rejected, the variant without leading/trailing spaces is tried and a note says so.

Practical Examples

New key for a server: choose Ed25519, click Generate keys, append the public line (it starts with ssh-ed25519 AAAAC3NzaC1lZDI1NTE5) to ~/.ssh/authorized_keys on the server and save the private key as ~/.ssh/id_ed25519 with permissions 600.

RSA for an old system: choose RSA 4096 when a device does not accept Ed25519. Generation takes a while; the elapsed seconds are shown and Cancel aborts it.

OpenSSH public key to PEM: paste ssh-ed25519 AAAA… user@host and click Convert to get an SPKI PEM starting with -----BEGIN PUBLIC KEY----- and MCowBQYDK2VwAyEA, the format libraries such as OpenSSL and Java expect.

Use an SSH key in code: paste an OPENSSH PRIVATE KEY (with its passphrase in the field), click Convert and get a PKCS#8 -----BEGIN PRIVATE KEY----- block for libraries that do not read the OpenSSH format.

How to Use This Tool

  1. Choose the key type

    In Generate pick the Algorithm: Ed25519 (Recommended), ECDSA P-256/P-384 or RSA 3072/4096. Key size is only active for RSA.

  2. Set an optional passphrase

    Type a passphrase into Passphrase (optional) to encrypt the private key; leave it empty for an unencrypted key.

  3. Generate

    Click Generate keys. For RSA a progress bar with elapsed time and Cancel appears.

  4. Save the keys

    Use Copy or Download under Public key and Private key.

  5. Import or convert existing keys

    Paste a key under Import or drop a key file, then click Import to inspect it or Convert to change its format.

Tips and Best Practices

  • Ed25519 keys are short, fast and accepted by OpenSSH 6.5+ and major Git hosts; use RSA only for systems that require it.
  • The "ssh-rsa uses SHA-1" warning concerns the old signature scheme; current OpenSSH signs with RSA keys using rsa-sha2-256/512.
  • A private key without a passphrase is only as safe as the disk it sits on; add one for keys on laptops.
  • A passphrase that starts or ends with a space is a different passphrase; the field shows a hint so it is not an accident.
  • Downloaded private keys need chmod 600 before ssh will use them.