How to Generate an SSH Key Online — Free Browser Tool (2026)

SSH key pairs are used to authenticate securely with remote servers, Git hosting services like GitHub and GitLab, and cloud infrastructure — without transmitting a password. brevio SSH Key Generator creates cryptographic key pairs entirely within your browser using the Web Crypto API, so the private key material is never transmitted to any server.

How to generate an SSH key pair online

1. Open brevio SSH Key Generator. No account required.
2. Choose a key type. Select EC P-256 (ECDSA with the P-256 curve) for a modern, compact key pair, or RSA 2048 for maximum compatibility with older systems.
3. Click "Generate Key Pair". The Web Crypto API generates a key pair in memory. This takes under a second.
4. Copy or download the public key. Click "Copy" or "Download .pub" to save the public key. This is what you paste into your server's ~/.ssh/authorized_keys file or GitHub's SSH key settings.
5. Download the private key immediately. Click "Download private key". The private key is only shown once — if you close the page, it is gone. Save it to ~/.ssh/ with permissions chmod 600.

EC P-256 vs RSA 2048 — which to choose

EC P-256 (ECDSA) keys are shorter, faster to generate, and computationally cheaper to use during handshakes. They are supported by all modern SSH servers and clients. RSA 2048 has been the standard for decades and is universally compatible, including with legacy systems that predate ECDSA support. If you are unsure, choose EC P-256 — it is the modern default used by GitHub's own documentation. For environments that must support very old OpenSSH versions (before 5.7, released 2011), use RSA.

How Web Crypto API key generation works

This tool calls window.crypto.subtle.generateKey() with a non-extractable-by-default algorithm specification, then exports the keys via exportKey('spki', ...) for the public key and exportKey('pkcs8', ...) for the private key. Both are encoded to PEM format (Base64-wrapped DER with header/footer lines). No network request is made at any point during this process.

How to use your generated key

Save the private key as ~/.ssh/id_ecdsa (or id_rsa for RSA) and run chmod 600 ~/.ssh/id_ecdsa to restrict access. Add the public key to a remote server by appending it to ~/.ssh/authorized_keys, or paste it into your cloud provider's SSH key management panel. For GitHub, go to Settings → SSH and GPG keys → New SSH key.

Frequently Asked Questions

Is this safe to use for real servers?

Yes, with the usual caveat: the private key is shown to you in a browser text area. Make sure you are on a trusted device with no malicious browser extensions. If you are highly security-conscious, generate keys offline using ssh-keygen on a trusted machine.

Can I add a passphrase?

The Web Crypto API does not support passphrase-encrypted private key export in the browser. To add a passphrase after generation, use: ssh-keygen -p -f ~/.ssh/id_ecdsa.

Does this support Ed25519?

Ed25519 is not yet supported by the Web Crypto API in major browsers. EC P-256 (ECDSA) is the closest browser-native equivalent — both are elliptic curve algorithms with similar security properties at their respective key sizes.