Generate an Ed25519 or RSA SSH key pair in the browser
You can separate the PUBLIC KEY and PRIVATE KEY, check the SHA-256 Fingerprint and self-verification result, and save them.
Generate an Ed25519 SSH key for GitHubConclusion: Create an Ed25519 key pair and add only the PUBLIC KEY to GitHub Settings
GitHub officially recommends ssh-keygen -t ed25519 for a typical new key and provides an RSA 4096-bit example for unsupported legacy systems.
Do not paste BEGIN OPENSSH PRIVATE KEY into GitHub. A public key starts with ssh-ed25519 or ssh-rsa.
GitHub's SSH user is git, not your account name. The test command is ssh -T [email protected].
Identify the key before registering it with GitHub
Add the device name to the comment or GitHub title, and use the fingerprint to compare keys within the agent and account.
Even when using the same key for both authentication and signing, check the Key Type setting in the GitHub UI.
| Item | How to check | judgment |
|---|---|---|
| Key Type | Ed25519 supported | Normally Ed25519 |
| Registration details | Leading string | PUBLIC only |
| SSH User | Connection command | git |
| Fingerprint | Compare with the GitHub list | Same key |
Add an SSH public key to GitHub
- Generate a Key Pair.
- Copy the PUBLIC KEY.
- Open SSH and GPG keys in GitHub Settings.
- Register a title and PUBLIC KEY under New SSH key.
- Add the PRIVATE KEY to ssh-agent and verify with ssh -T.
Perform ssh-agent operations in the OS Terminal. You cannot add keys from a Browser Tool to an OS Agent.
Connection verification command
ssh-add ~/.ssh/id_ed25519
ssh -T [email protected]
ssh -vT [email protected]Do not confuse PUBLIC KEY and PRIVATE KEY.
| types | Representative ways to distinguish them | Where to place it | Handling |
|---|---|---|---|
| PUBLIC KEY | ssh-ed25519 AAAA... or ssh-rsa AAAA..., filename ending in .pub | GitHub, GitLab, and server authorized_keys | Can be registered and shared |
| PRIVATE KEY | Starts with BEGIN OPENSSH PRIVATE KEY and the file name does not contain .pub | Your device that uses an SSH Client | Secret. Do not publish, send, or Commit it. |
Paste the PUBLIC KEY into GitHub or a server. Keep the PRIVATE KEY only on the originating device. Knowing a public key does not mean that the corresponding private key can be created, but if a private key is exposed, remove that key from its registered destinations and replace it with a new key pair.
Steps to generate an SSH key in the browser
- Check whether the destination supports Ed25519 and normally choose Ed25519.
- Choose RSA 3072 or 4096 bit only when compatibility requirements exist.
- Enter a comment that identifies the device or purpose, and a storage name that does not overwrite an existing key.
- After generation, check for "Signature/verification succeeded," the key type, and the SHA-256 fingerprint.
- Save PUBLIC KEY and PRIVATE KEY separately, and set appropriate OS-level permissions on the PRIVATE KEY.
The current tool's PRIVATE KEY is not encrypted with a passphrase. If your organization policy requires a passphrase, use OpenSSH ssh-keygen or similar.
After saving, use OpenSSH to check the format and pair.
ssh-keygen -y -f ~/.ssh/id_ed25519 > derived.pub
ssh-keygen -lf ~/.ssh/id_ed25519.pub -E sha256ssh-keygen -y re-derives a public key from an OpenSSH-format private key and writes it to standard output. Compare it to verify that the PUBLIC KEY generated originally matches the key material. -l -E sha256 displays the Public Key Fingerprint. Because the Comment is not part of the key material, compare the Algorithm and Base64 portions.
What DevelopTools' SSH key generator can do
| Item | Current tool specification |
|---|---|
| Algorithm | Ed25519, RSA 3072 bit, RSA 4096 bit |
| Generation source | Use the Web Crypto API in an HTTPS secure context. Do not use Math.random |
| Public key | OpenSSH authorized_keys format. Begins with ssh-ed25519 or ssh-rsa and may include an optional Comment. |
| private key | Unencrypted OpenSSH private key format. Begins with BEGIN OPENSSH PRIVATE KEY |
| verification | Immediately after generation, sign and verify random data, then calculate the SHA-256 fingerprint from the public key Blob |
| Save | Download the public key as the configured name.pub and the private key as the configured name. Only the public key can be copied to the clipboard. |
| Preserve | Keep the key in memory and on the generating page display, and discard references on reset, settings changes, and pagehide |
| Unsupported | Passphrase encryption, PEM / PKCS#8 output, RSA 2048, ECDSA, FIDO/U2F, existing key loading, and ssh-agent operations |
| Communication and persistence | Do not use fetch in the key generation module or save keys to localStorage, sessionStorage, or IndexedDB |
The Tool performs key Pair generation, OpenSSH formatting, Fingerprint calculation, and signing and verification in the Browser. It does not register with GitHub, edit authorized_keys, change File Permissions, add to ssh-agent, or make SSH connections.
Checklist for securely handling private keys
- Do not paste a PRIVATE KEY into GitHub, an Issue, Chat, Source Code, or CI Log.
- After downloading, set permissions or ACLs so that only the owner can read it
- Do not place it under the Repository, and do not overtrust .gitignore as the only safeguard against accidental Commits.
- If a leak is suspected, remove the public key from the registered destination and replace it with a new key pair
- On shared devices, reset after generation and check residual data in the Downloads folder and clipboard
The current SSH key page disables third-party scripts, and its key generation module has no external transmission or persistence processing. However, the tool cannot protect against device malware, browser extensions, screen recording, or download-folder backups. Do not conclude that being online is absolutely safe; check the usage environment as well.
Check the destination and OpenSSH specifications using primary sources
- OpenBSD Manual：ssh-keygen(1)
- OpenBSD Manual：ssh-agent(1)
- GitHub Docs：Generating a new SSH key
- GitHub Docs：Adding a new SSH key
- GitHub Docs：Permission denied (publickey)
- MDN：SubtleCrypto.generateKey()
- MDN：SubtleCrypto.exportKey()
GitHub's instructions are for connecting to GitHub, while the OpenSSH Manual covers key operations common to clients and servers. Steps differ by OS, hosting service, and sshd policy, so prioritize the current official documentation for the destination.
Example: Add a Work Laptop key to GitHub
Add work-laptop to the comment and GitHub title.
Even with multiple devices, you can identify which key it is in the GitHub list.
- Generate Ed25519
- Save Private
- Public Copy
- GitHub registration
- Add agent
- ssh -T
Because the success message displays the GitHub username, confirm that it is the expected account.
Frequently asked questions
- Are generated keys sent to the DevelopTools Server?
- The current SSH key Page generates keys in the Browser with the Web Crypto API, and its key-generation Module does not send over the Network or save to Storage. Public key Copy and key File Download run only when initiated by the user.
- Should a PRIVATE KEY be registered with GitHub?
- No. Register the PUBLIC KEY beginning with ssh-ed25519 or ssh-rsa. Keep the private key beginning with BEGIN OPENSSH PRIVATE KEY only on your own Client device.
- Can a private key with a Passphrase be generated?
- The current Tool supports only unencrypted OpenSSH Private Keys. Use ssh-keygen or similar if you need a passphrase-protected OpenSSH key.