A key pair only you have seen.
The pair is created by your browser. The public half is for servers and colleagues, while the private half stays in this tab until you save it yourself.
The default for new SSH access and Git: a short public key with modern OpenSSH support.
The OpenSSH file is encrypted with bcrypt and AES-256-CTR. The phrase is not written into the result and is cleared from the form after generation.
Which key to take
Four types cover almost everything a person or a company needs.
- 01
Ed25519 for access
The default choice for servers, Git and signing: short, fast, and accepted everywhere modern software runs.
- 02
X25519 for exchange
In the age profile, give the recipient to the sender and keep the identity with the receiver. Both values use native age formats.
- 03
ECDSA and RSA where rules require them
P-256 and RSA-4096 serve a specific compatibility policy or older system. For ordinary new SSH access, choose Ed25519.
QR moves a key without the cloud
A public key scanned from the screen lands on a phone with no copy-paste, no messenger and no file service in between.
The private half is hidden by default and its QR appears only after separate confirmation. The reason is simple: the shoulder next to you and the screen recording you forgot about.
Is a browser-made key trustworthy
Randomness comes from the operating system through WebCrypto — the same source command-line tools use. The difference is only in the interface.
Why does age have no passphrase field
A native age identity is a plaintext secret format. Protect the file with your chosen system key store or secret manager.
Where should the private key live
In a password manager or system keychain. Not in mail, chats, or shared folders. The service receives no copy.
Keys are yours. The contour should be too.
Mail, files, knowledge and AI on hardware you control, each contour encrypted with its own key.