b2KIT

SSH Key Generator

Generate SSH key pairs (RSA, ECDSA, Ed25519) in OpenSSH format with optional passphrase protection.

Tested tool guide Tested browser tools Checked August 16, 2026

What SSH Key Generator does and how it behaves

An SSH key pair is not two independent secrets. The private key is generated first, and the public key is mathematically derived from it, so this tool's real output is one random event that appears as two blocks: a single-line public key and a multi-line private key in OpenSSH format, optionally encrypted with a passphrase you choose. What most people get wrong is which block to send where: the public key goes on the server; the private key - the block whose header says PRIVATE KEY - never leaves your machine.

How the result is produced

1

How the pair is produced

Generation starts with the private key; the public key is a mathematical function of it. RSA's public half is the product of two large primes, Ed25519's is derived from a 32-byte seed, and ECDSA's is a point on the chosen NIST curve. Because of this derivation, one private key always produces the same public key, so a lost public key can be regenerated from the private one.

2

Passphrase and file format

A passphrase does not change the key; it encrypts the private key block at rest using a bcrypt-based key derivation that makes guessing slow. A forgotten passphrase means the key is lost: the tool stores nothing, and there is no recovery path. Without a passphrase the private key block is stored plain. Everything runs in the browser, and no key material or passphrase is uploaded anywhere.

Good uses

  • First password-less login to a server you run: generate a pair, append the public key line to ~/.ssh/authorized_keys on the server, and keep the private key file on your machine.
  • Register a deploy key for a GitHub or GitLab repository, or a key for a cloud VM console - places that accept only the public key text.
  • Rotate a key after an exposure, a lost laptop, or a departing team member: create a fresh pair and replace the old public key everywhere it was installed.

Limits and checks

  • The two outputs are easy to swap because both look like key text. The public key is one line starting with the algorithm name (ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256); the private key is a multi-line block whose header contains PRIVATE KEY. A private key pasted into authorized_keys will not authenticate, and nothing will tell you why.
  • The passphrase protects the file, not the identity. Once an SSH agent holds the unlocked key, the passphrase is bypassed for that session, and anyone who copies the private key file and knows the passphrase can connect as you. The passphrase is not part of the key: re-encrypting with a different passphrase leaves the key and its public half unchanged.
  • Not every key type works everywhere. Modern OpenSSH refuses RSA keys under 1024 bits, Ed25519 needs OpenSSH 6.5 or later on both ends, and ECDSA curves must match what the server supports. If a server rejects a fresh key, suspect software versions rather than the key. When copying the private key block, include the BEGIN and END lines or the file will not parse.

Common questions

I set a passphrase and now I have forgotten it. Can this tool recover the key?

No. The passphrase is never stored with the key, the encryption is deliberately expensive to guess, and there is no back door in this tool or in OpenSSH itself. The only remedy is to generate a new pair and install the new public key on every server that has the old one. Treat the forgotten key as lost.

Which block goes into authorized_keys on the server?

The single-line public key, the one starting with ssh-ed25519, ssh-rsa, or ecdsa-sha2-nistp256 and usually ending with your comment such as user@host. Add it as one line in ~/.ssh/authorized_keys. The multi-line block starting with -----BEGIN OPENSSH PRIVATE KEY----- is the private key; it stays on your machine and must never be pasted into authorized_keys or uploaded anywhere.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.