SSH key generator

Generate key makes a key pair with the browser's own WebCrypto: Ed25519, the default in current OpenSSH and the right choice for any server from the last decade; ECDSA on the NIST curves P-256, P-384 or P-521; or RSA at 2048, 3072 or 4096 bits with the public exponent 65537, for old systems that take nothing else. The public half is the line an OpenSSH server wants in ~/.ssh/authorized_keys — the type, the key in base64, the comment — shown with its SHA-256 fingerprint as ssh-keygen -l prints it, and the older MD5 form some consoles still show. The comment is a label: editing it changes the line and the files, not the key or its fingerprint.

There is no mouse to wiggle. PuTTYgen asks you to move the pointer because it gathers randomness of its own. A browser draws random numbers from the operating system's generator, the same source ssh-keygen uses; a page cannot add to it, and it does not need anything added. Each press makes a new key, and nothing is kept once the tab is closed.

The files. PuTTY .ppk is version 3 unless you tick version 2, for PuTTY 0.74 and older. With a passphrase it is encrypted with AES-256 under a key from Argon2id at 8 MiB and 13 passes; PuTTYgen times its own pass count to a tenth of a second on its machine, this page uses a fixed count, and PuTTY reads either. Version 2 turns the passphrase into a key with one round of SHA-1, which is fast to attack: prefer version 3. OpenSSH is the openssh-key-v1 file ssh-keygen writes, protected as ssh-keygen protects it — bcrypt_pbkdf at 16 rounds and AES-256 in counter mode. PEM is the older PKCS#1 (RSA), SEC1 (ECDSA) or PKCS#8 (Ed25519) block, and is written only without a passphrase. .pub is the authorized_keys line as a file; RFC 4716 is the ---- BEGIN SSH2 PUBLIC KEY ---- form PuTTYgen's Save public key writes.

Argon2, BLAKE2b, bcrypt_pbkdf, Blowfish — its starting tables worked out on the page from the digits of pi — and MD5 are written out in this page; AES, SHA and the key arithmetic are the browser's. The .ppk writer reproduces PuTTY's own test files byte for byte, and ssh-keygen reads the OpenSSH and PEM files it writes.

Keep the private key private. It is on screen only after you press Show, and Copy puts it on the clipboard, where other programs can read it: saving the file is the safer route. The page makes no network requests; save it and run it with the network off if you want to be sure. It does not make DSA keys (switched off in OpenSSH 7.0), Ed448 keys, security-key (sk-) keys or certificates. To convert a key you already have, use the PPK converter.