LOCAL BY DESIGN / OPENSSH COMPATIBLE

Your keys.
Your machine.

Generate an SSH key pair in your browser, then prepare your server login configuration. No account, credentials or server connection needed.

WebCrypto randomness · No key uploads · No saved keys

01 / CREATE YOUR IDENTITY

Generate a key pair

Ed25519 is compact and modern. RSA 3072 offers roughly 128-bit classical security; 4096 uses larger keys and is slower. The ssh-rsa key type does not require deprecated SHA-1 signatures: modern OpenSSH uses RSA SHA-2.

A label, not a password. Included in exported keys. Up to 256 UTF-8 bytes.

Ready. Keys stay in memory until you download or clear them.

02 / SET UP YOUR CONNECTION

SSH login configuration

This creates client settings, not remote users or passwords. No connection is made.

DNS name, IPv4, or bare IPv6. No https:// prefix or port.

Move your downloaded private key to this path; this is not the browser download location. For RSA use id_rsa. Windows: C:/Users/Name/.ssh/id_ed25519. Quoted paths can contain spaces; config tokens and environment substitutions are intentionally unsupported.

Review and append to ~/.ssh/config; never overwrite existing configuration. Earlier Host entries may take precedence.

03 / CONNECT WITH CONFIDENCE

From download to first login

  1. Save both files. Move the private key and .pub file to your SSH directory, matching IdentityFile above. The examples below use Ed25519 and Linux/macOS; use id_rsa for RSA and replace the example host, port and username.
  2. Protect your private key locally.
    mkdir -p ~/.ssh
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
ssh-keygen -p -f ~/.ssh/id_ed25519
    On Windows, use your user-profile .ssh folder and restrict the private file's ACL to your account with Windows file permissions. Unix chmod commands do not configure Windows ACLs.
  3. Install only the public key. You must already have authorized access to the server.
    ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 22 deploy@server.example.com
    If ssh-copy-id is unavailable, use your hosting provider's authorized-key setup or append the .pub line to the remote user's ~/.ssh/authorized_keys through an existing authenticated session. On a Unix server, the user's ~/.ssh should be mode 700 and authorized_keys mode 600, owned by that user. Never transfer the private key.
  4. Review and append your config. Save the snippet in your local ~/.ssh/config without replacing other entries; on Unix set chmod 600 ~/.ssh/config. Then run ssh my-server using your chosen alias.
  5. Verify the server separately. Confirm the server's host-key fingerprint with your administrator or provider before accepting it. The fingerprint generated above identifies your user key, not the server. Keep your current session open and retain password/recovery access until a new key-based login succeeds. Do not blindly disable password authentication.
  6. Optional: use an agent. On Linux/macOS, start an agent with eval "$(ssh-agent -s)" if needed, then ssh-add ~/.ssh/id_ed25519. On Windows, use your configured OpenSSH Authentication Agent. An agent can cache unlocked keys; lock/remove them when no longer needed. IdentitiesOnly yes keeps the configured identity selected.

Reset drops page references and revokes download URLs. JavaScript garbage collection, browser memory, OS swap and saved downloads cannot be securely erased by this app. No keys are stored in app storage, URLs or analytics. Static assets are downloaded from this origin; generated key data never enters a request.