🔐 RSA Key Generator

Generate an RSA key pair for learning, testing and throwaway lab use. The pair is generated on our server and sent to your browser, so treat any key from this page as public knowledge - never use it to protect anything real. For a key you depend on, use the ssh-keygen commands shown below on the machine that will hold it.

📌 Public Key (OpenSSH Format):
🔑 Fingerprint (SHA-256):
Calculating...
🔐 Private Key (PEM Format):
⚠ī¸ Important Security Notice: Keep your private key secure and confidential. Never share it with anyone. Store downloaded keys in a secure location with proper permissions (chmod 600).

ℹī¸ What is this tool generating?

  • Public Key - Shared with servers and services; saved in OpenSSH format (.pub)
  • Private Key - Keep secret; used to authenticate and decrypt messages
  • Fingerprint - SHA-256 hash to verify key identity and authenticity
  • Comment - Optional identifier to track which key is which

💡 How to use these keys:

  • Paste the public key to ~/.ssh/authorized_keys on remote servers
  • Use the private key with SSH clients (PuTTY, WinSCP, Termius, OpenSSH, etc.)
  • Set correct permissions: chmod 600 ~/.ssh/private-key.pem

✅ Key Specifications:

Field Description
Algorithm RSA (Rivest-Shamir-Adleman)
Key Size 2048-bit (256 bytes)
Public Key Format OpenSSH standard format
Private Key Format PEM (Privacy Enhanced Mail)
Fingerprint Hash SHA-256
Use Cases SSH, encryption, digital signatures, SSL/TLS

Note: This key pair is generated on our server, not in your browser, and the private key travels over the network to reach you. We do not store it, but it has left the machine you are sitting at, which is enough to disqualify it from protecting anything you care about. Only the SHA-256 fingerprint is computed locally.

Where this key is actually made

Read the code before you trust the key. Pressing Generate posts to the SimpleMoney API, which creates the 2048-bit RSA pair and returns the private key as PEM text. The page then posts that private key back to the same API to have the OpenSSH public line derived from it. So the secret crosses the network twice. The notice further down the page saying keys are generated locally and never transmitted does not describe what the script does; only the SHA-256 fingerprint is computed in your browser.

Treat anything produced here as a throwaway. It is fine for testing a config file, a tutorial or a screenshot. It is not fine in authorized_keys or under a certificate, because a private key that was generated elsewhere and travelled to you has no meaningful secrecy left, whatever the transport.

Doing it properly takes one line

ssh-keygen -t ed25519 -C "you@host"          # what you want for SSH
ssh-keygen -t rsa -b 4096 -C "you@host"      # RSA if the server is old
ssh-keygen -y -f ~/.ssh/id_rsa > id_rsa.pub  # rebuild a lost public key
ssh-keygen -lf ~/.ssh/id_rsa.pub             # the same SHA256: fingerprint

For a TLS key rather than an SSH one, openssl genrsa -out private.key 2048 writes PKCS#1 PEM. Either way the file should end up chmod 600 and owned by the account that uses it - OpenSSH refuses a key that other users can read.

Frequently asked questions

Can I use a browser-generated RSA key for SSH access?

Not for anything you care about. Use it on a disposable lab box if you like, but a key guarding a real server should be generated by ssh-keygen on the machine that will hold it and never leave that disk.

What is the SHA256: fingerprint used for?

It identifies a key without exposing it. The page hashes the decoded public-key blob and prints it base64 without padding, exactly as ssh-keygen -lf does, so the two strings can be compared when you need to confirm which key a server has.

Is RSA 2048 still fine for SSH?

It works everywhere and is accepted, but ed25519 is the better default now: shorter keys, faster authentication, and no chance of falling back to the SHA-1 ssh-rsa signature that OpenSSH disabled in version 8.8.