SSH key generator that stays in your browser
Create an Ed25519 or RSA 4096 key pair in OpenSSH format, ready for ssh, sftp, Git and CloudFile. The private key never leaves your device.
Generated in your browser. Keys are created with the Web Crypto API on this page. The private key never leaves your device: nothing is sent to or stored on our servers.
Optional label stored with the key, usually your email or user@host.
Prefer the terminal? ssh-keygen -t ed25519 -C "you@laptop" does the same.
From key pair to logging in.
1.Save both files
Download them into the .ssh folder in your home directory and lock down the private key. On Windows, use C:\Users\you\.ssh; OpenSSH there checks file permissions too.
mkdir -p ~/.ssh && chmod 700 ~/.ssh mv ~/Downloads/id_ed25519 ~/Downloads/id_ed25519.pub ~/.ssh/ chmod 600 ~/.ssh/id_ed255192.Check the fingerprint
ssh-keygen prints the same SHA256 fingerprint as this page, so you know the file arrived intact.
ssh-keygen -lf ~/.ssh/id_ed25519.pub3.Add the public key to the server
In CloudFile, open the SFTP user, choose SSH key or Password + SSH key, and paste the contents of the .pub file. Elsewhere, append it to ~/.ssh/authorized_keys.
cat ~/.ssh/id_ed25519.pub # copy this line4.Connect
ssh and sftp pick up id_ed25519 and id_rsa from ~/.ssh automatically. Point other clients (FileZilla, WinSCP, rclone) at the private key file.
sftp -i ~/.ssh/id_ed25519 -P 22 [email protected]
CloudFile details: SSH keys for SFTP users
Questions about SSH keys.
Is it safe to generate an SSH key in the browser?
Yes, as long as the key is generated locally. This page uses your browser's Web Crypto API, the same cryptography browsers use for HTTPS. The private key is created and kept in this tab; nothing is uploaded, logged or stored. You can disconnect from the network after the page loads and it still works.
Should I use Ed25519 or RSA?
Ed25519 for anything current: keys are short, fast and secure, and OpenSSH has supported them since 2014. Choose RSA 4096 only for old servers or appliances that don't accept Ed25519. Both work with CloudFile.
Is the private key protected by a passphrase?
No, the downloaded key is unencrypted, which is what automated jobs usually need. To add a passphrase, run ssh-keygen -p -f ~/.ssh/id_ed25519 after saving the file.
What format are the keys in?
The public key is a single OpenSSH line (ssh-ed25519 AAAA… comment), and the private key is in the OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----) that ssh-keygen writes. OpenSSH, Git, rclone and most SFTP clients read both. PuTTY and WinSCP can import the private key and convert it to .ppk.
What is the fingerprint for?
It's a short hash of the public key, printed the same way as ssh-keygen -l. Compare it to confirm that a server or colleague has the right key without pasting the whole line.