A key pair only you have seen.
Choose an exact working format, not just an algorithm. Your browser creates the pair: the public half can travel, while the private half stays in this tab until you save it yourself.
The default for new SSH access and Git: a short public key with modern OpenSSH support.
The OpenSSH file is encrypted with bcrypt and AES-256-CTR. The phrase is not written into the result and is cleared from the form after generation.
Which key to choose
The profile name tells you which program will read the result.
- 01
Ed25519 is the normal new SSH key
Put the public line in authorized_keys and give the private file to OpenSSH. A passphrase protects the saved copy.
- 02
age X25519 encrypts files
Give the recipient to the sender and keep the identity with the receiver. Both values use native age formats, with no intermediate PEM.
- 03
Use ECDSA and RSA when the environment asks
P-256 and RSA-4096 serve a specific compatibility policy or older system. For ordinary new SSH access, choose Ed25519.
QR moves a key without the cloud
A phone can take the public half from the screen without a messenger or file service between the devices.
A private QR appears only after the key is revealed and separately confirmed. An oversized private file is neither compressed nor split into incompatible fragments.
Can OpenSSH read the downloaded file directly
Yes. All three SSH profiles export a real encrypted OPENSSH PRIVATE KEY file and its matching public-key line.
Why does age have no passphrase field
A native age identity is a plaintext secret format. Protect the file with your chosen system key store or secret manager.
Where do the keys remain
Only in this page’s memory and in files or clipboard content you create explicitly. The service receives no copy.