Generating an SSH keypair is a ssh-keygen -t ed25519 away for most of us — until you're on a locked-down machine, a Chromebook, a shared computer, or just don't want to open a terminal to onboard a new server. That's the gap CloudAIRambo's SSH Key Generator fills: a free, browser-based tool that generates RSA, ED25519, and ECDSA keypairs entirely client-side.
How it works
The tool runs on the Web Crypto API, which means key generation happens in your browser sandbox — not on a server. That matters for something as sensitive as a private key: nothing gets uploaded, logged, or stored remotely. You pick an algorithm, generate, and download.
Choosing an algorithm
If you've ever stared at the -t flag in ssh-keygen and wondered which value to pick, the tool's guidance lines up with current best practice:
ED25519 — the modern default. Smaller keys, faster signing, and strong security at a shorter key length than RSA. Use this unless you have a specific reason not to.
RSA (2048–4096 bit) — still the safest choice for legacy systems, older hardware security modules, or any environment that hasn't caught up to elliptic curve crypto. 4096-bit is the recommended floor if you're stuck on RSA.
ECDSA (P-256/P-384/P-521) — a middle ground: smaller than RSA, with wider hardware support than ED25519. Useful if your target system supports elliptic curves but not the newer curve25519-based algorithms.
Output formats
Each generated keypair comes packaged as:
OpenSSH private key — the format your Linux/macOS ~/.ssh/ directory expects
PuTTY PPK — for Windows users on PuTTY or WinSCP
Public key — ready to paste into GitHub/GitLab/Bitbucket SSH settings, or appended to a server's authorized_keys
There's also a FIPS 140-2 awareness mode that restricts generation to NIST-approved algorithms, which is a nice touch if you're working in a government or enterprise compliance context and need to rule out non-approved curves by default.
When this is actually useful
To be clear — if you've already got a terminal open, ssh-keygen is faster and better understood by tooling. Where a browser-based generator earns its place:
Onboarding docs where you want a zero-install walkthrough for less technical teammates
Locked-down or shared machines where you can't run arbitrary CLI tools
Quickly generating a throwaway keypair for a demo or CI test without touching your local .ssh config
A couple of things worth checking before you rely on it
Confirm your browser tab is closed/cleared after copying the private key, since it will sit in the DOM/clipboard until you navigate away
If you're setting up production infrastructure, still prefer generating keys on the machine that will use them (or a hardened workstation), rather than a general browser session, per usual key-hygiene practice
Full tool here: freetoolshub.cloudairambo.com/ssh-key-generator
Do you generate SSH keys locally, or have you found browser-based tools like this useful for onboarding/demos? Curious how others handle it.
Top comments (0)