Back to tools

SSH Key Generator

Build the exact ssh-keygen command, a purpose-based key comment, and a ready-to-use ~/.ssh/config shortcut. This page never generates a real key — it only builds the command you run yourself.

No key is ever created in your browser.

A web page that hands you a private key is exactly the thing to distrust — the private half never should leave the machine it was born on. This tool only assembles the ssh-keygen command below. You copy it and run it yourself, in your own terminal, where the key is actually generated and stays.

Step 1

Choose an algorithm

Both produce a real key pair. The difference is size, speed, and which servers accept them.

Ed25519 is a modern elliptic-curve algorithm: short keys, fast to generate and to authenticate with, and supported by every SSH server from the last decade or so. Use this unless something specific forces you off it.

Use you@purpose-year, not the default machine@host comment. When authorized_keys on a server ends up with five keys in it, the comment is the only thing telling you which laptop or purpose each one belongs to.

Leave blank to accept ssh-keygen's default location (shown as the placeholder above). Only set this if you're keeping multiple keys side by side.

Higher makes brute-forcing a stolen, passphrase-protected key slower — and also makes every unlock slower. Leave blank for the ssh-keygen default.

Result

Run this in your own terminal

ssh-keygen -t ed25519 -C 'you@wespner-vps-2026'

Saved to the default location: ~/.ssh/id_ed25519 (and ~/.ssh/id_ed25519.pub).

Passphrase

You'll be asked for one — here's the trade-off

ssh-keygen will prompt you to type a passphrase twice, or press Enter twice for none. Nothing above sets it for you — a passphrase belongs in your terminal, never in a saved command.

With a passphrase: if the key file itself is ever stolen — a laptop theft, a leaked backup — it's useless without the passphrase. The cost is typing it every time you connect.

Without one: zero friction, but anyone who gets the private key file gets in immediately. ssh-agent (Linux), the macOS Keychain, or Pageant (PuTTY) solve the friction problem: unlock once per session and every connection after that is silent, so there is rarely a good reason to skip the passphrase.

Why it matters

Ed25519 vs RSA, plainly

Ed25519 is a newer elliptic-curve algorithm: the key is a few hundred bytes instead of several kilobytes, math is faster on both ends, and it's been the recommended default on any server from the last decade or so.

RSA 4096 is older and slower, but understood by literally every SSH implementation ever shipped. Reach for it only when a server is too old or too locked-down to accept Ed25519 — legacy network gear, some managed hosts, ancient enterprise appliances. If you don't know whether that applies to you, it doesn't: use Ed25519.

Step 2

Where the key is going

These details feed both the copy-to-server commands below and the SSH config shortcut in step 3.

Getting it there

Put the public key on the server

Only the .pub file ever leaves your machine. The private key (no .pub) never gets copied anywhere.

Easiest: ssh-copy-id (macOS/Linux, or WSL/Git Bash on Windows)

ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]

Manual route: append to authorized_keys yourself

cat ~/.ssh/id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

That one-liner sets ~/.ssh to 700 and authorized_keys to 600 on the way in — SSH silently ignores both files if permissions are looser than that. Use the chmod & chown calculator if you ever need to fix those permissions after the fact, or want to see exactly what those two modes grant.

Step 3

Build a ~/.ssh/config shortcut

Turns ssh [email protected] -p 22 -i ~/.ssh/id_ed25519 into just ssh wespner-vps.

~/.ssh/config

Host wespner-vps
    HostName play.wespner.eu
    User deploy
    Port 22
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Paste that block into ~/.ssh/config (create the file if it doesn't exist yet), then connect with just ssh wespner-vps — no user, host, port or -i flag needed ever again.

Windows

OpenSSH in PowerShell, or PuTTYgen

Windows 10/11 ships OpenSSH by default — the ssh-keygen command above works unchanged in PowerShell or Command Prompt. Keys land in C:\Users\you\.ssh\ (PowerShell resolves ~ the same way).

ssh-copy-id isn't bundled with Windows OpenSSH. Use the PowerShell equivalent instead:

PowerShell copy-to-server

Get-Content ($env:USERPROFILE + '\.ssh\id_ed25519.pub') | ssh [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Prefer PuTTY/WinSCP instead? Generate with PuTTYgen (Generate → move the mouse → Save private key as .ppk), then copy the public key text shown at the top of its window straight into authorized_keys. Config lives at the same ~/.ssh/config path if you are on the OpenSSH client — Pageant/WinSCP use their own saved-sessions list instead.

macOS / Linux

Terminal, natively

Run the command above directly in Terminal. Keys land in ~/.ssh/, and ssh-copy-id ships with almost every distro (macOS: brew install ssh-copy-id if it is missing).

Config lives at ~/.ssh/config — same block as step 3, no translation needed.

To avoid retyping your passphrase every connection: ssh-add ~/.ssh/id_ed25519 loads it into ssh-agent for the session. On macOS, ssh-add --apple-use-keychain ~/.ssh/id_ed25519 (or UseKeychain yes in the config block) remembers it across reboots via Keychain.

Running your own game server?

Wespner game servers with DDoS protection, NVMe drives and activation within minutes.

Browse hosting