RSA and ECDSA Key Pair Generator
Generate RSA, ECDSA or Ed25519 key pairs as PEM and OpenSSH keys.
Use via API
Generate one new signing key pair (ECDSA, Ed25519 or RSA up to 4096 bits): PKCS#8 private key PEM, SPKI public key PEM, OpenSSH public key line and SHA-256 fingerprint. The key is created on PithLab's server and not stored; generate locally for production secrets. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/key-pair-generator
curl https://pithlab.com/api/v1/tools/key-pair-generator \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"algorithm":"ed25519","comment":"deploy@ci"}'About the Key Pair Generator
Generate RSA, ECDSA and Ed25519 key pairs in your browser. Export the private key as PKCS#8 PEM, the public key as PEM and OpenSSH, with its SHA256 fingerprint.
How to use the Key Pair Generator
- Choose an algorithm: ECDSA P-256 or Ed25519 for fast, small keys, or RSA 3072 or 4096 where RSA is required.
- Optionally enter a comment such as you@laptop, which is added to the OpenSSH public key line.
- Press Generate. The key pair is created with your browser's Web Crypto API and never leaves this page.
- Copy or download the private key and keep it secret. Share only the public key or the OpenSSH line.
Examples
Input
Ed25519, comment me@laptop
Output
e.g. ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOZuzLeKA6OBjAedp3PYqCfx3jErDp90bAnkX7jv40bN me@laptop
Input
ECDSA P-256, no comment
Output
e.g. 256 SHA256:URltYab/qP7r9sRW8QhKgUK1W77kC2cCw75V+CE2xiU no comment (ECDSA)
Frequently asked questions
Is it safe to generate a private key in the browser?
The keys are made by the Web Crypto API built into your browser, using its secure random number generator, and nothing is sent to a server. For keys that protect production systems, many teams still prefer to generate them on the machine that will use them with ssh-keygen or openssl.
Which algorithm should I choose?
Ed25519 is the modern default for SSH. ECDSA P-256 is widely supported for TLS and JWTs. Choose RSA 3072 or 4096 only when a system requires RSA; RSA 2048 is the minimum still accepted.
What is the difference between RSA-PSS and RSASSA-PKCS1-v1_5?
They are two signature schemes for the same kind of RSA key. The exported PEM key works with either. PSS is the more modern padding; PKCS#1 v1.5 is what most certificates and SSH servers still use.
How do I use the key with SSH?
Add the OpenSSH line to ~/.ssh/authorized_keys on the server. Save the private key as a file such as ~/.ssh/id_ed25519 with chmod 600. OpenSSH 7.8 and later read PKCS#8 PEM private keys.
Why is Ed25519 missing from the list?
Your browser does not support Ed25519 in Web Crypto yet. Recent versions of Chrome, Edge, Firefox and Safari do.