How to generate a key pair

One key you publish, one you never show anyone. Getting that distinction right is most of the work.

A key pair is two mathematically linked keys. The public key can be handed to anyone; the private key must never leave your control. What one does the other undoes — so a signature made with the private key can be checked by anyone holding the public one.

Step-by-step

1. Choose a key type. Ed25519 if you have a free choice, ECDSA P-256 for the widest compatibility, RSA when something requires it.
2. Generate. Both keys appear as PEM.
3. Save the private key somewhere safe — a password manager, or an encrypted file. Not a note, not a repository, not a chat message.
4. Distribute the public key freely.

Verified before you are handed it

A key pair that does not actually work is a nasty failure, because you may not discover it until you need to verify something months later. Before the tool shows you anything, it signs a test value with the generated private key and verifies it with the generated public key. If that round trip fails, you get an error instead of a broken pair.

Choosing a type

• Ed25519 — small keys, small signatures, fast, and no parameter choices to get wrong. The best default when the other side supports it.
• ECDSA P-256 or P-384 — the most broadly supported elliptic curve option, accepted almost everywhere.
• RSA 2048 or 4096 — much larger and slower, still required by plenty of older systems. 2048 remains acceptable; 4096 if a policy demands it.

Bigger is not automatically better across families. RSA-4096 is not "stronger than" Ed25519; the security levels are broadly comparable and Ed25519 is faster with far less that can go wrong.

Frequently asked questions

Is the private key generated on my machine?

Yes. It is produced by your browser's own cryptographic implementation and never transmitted. Closing the page discards it, so save it before you navigate away.

Can I use this key for SSH?

The output is PEM, which is not the format OpenSSH expects for its own key files. Converting is possible with ssh-keygen, but for SSH access you are better off generating the key with ssh-keygen on the machine that will use it.

Should I put a password on the private key?

The tool exports an unencrypted PEM. If you are storing it anywhere other than a password manager, encrypt it — the file encryption tool on this site will do it.