ssh-keygen -t ed25519 -a 100 -C "me@laptop"

ssh-keygen Command Builder

Choose a key type and where it goes, and get the ssh-keygen command plus the steps that follow: copying the public key to a server and checking its fingerprint.

Saved in ~/.ssh/
Options
Generated command
Next steps

Which key type to use

Use Ed25519 for new keys: short, fast, and supported by every OpenSSH release since 6.5. Choose RSA with 4096 bits only for old systems or appliances that cannot handle Ed25519. If you own a FIDO2 security key such as a YubiKey, the -sk types keep the private key on the hardware, so a stolen laptop alone cannot log in. Always set a passphrase on keys you use interactively; ssh-agent means you type it once per session, not every connection.

Generate SSH keys with ssh-keygen

This builder writes ssh-keygen commands for every common case: an everyday Ed25519 key, a 4096-bit RSA key for legacy hosts, and ed25519-sk or ecdsa-sk keys backed by a FIDO2 hardware token, with resident (discoverable) and verify-required options. It sets a descriptive comment, a separate file per purpose so you do not overwrite id_ed25519, and extra key derivation rounds that make a stolen key file harder to crack. It also prints the ssh-copy-id, fingerprint, and passphrase-change commands you need next.

ssh-keygen FAQ

Will this overwrite my existing key?

ssh-keygen asks before overwriting a file that exists, but it is easy to answer yes by reflex. Give each key its own file with -f, such as ~/.ssh/id_ed25519_work, and point at it from ~/.ssh/config with IdentityFile.

What does -a do?

It sets how many rounds of the bcrypt key derivation function protect the private key's passphrase. More rounds make brute-forcing a stolen key file slower, at the cost of a slightly slower unlock. 100 is a sensible value; the default is 16.

What is a resident FIDO2 key?

With -O resident the key handle is stored on the security key itself, so on a new machine you can run ssh-keygen -K to download it and log in without copying any files. Without it, you need the small key handle file from the machine where you generated it, alongside the hardware.

How do I add a passphrase to a key that has none?

Run ssh-keygen -p -f ~/.ssh/id_ed25519. It asks for the old passphrase, empty in this case, and the new one, and rewrites the file in place without changing the key itself.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. WireGuard Config Generator Produce matching server and peer configs with AllowedIPs, DNS, keepalive, and NAT forwarding rules. Reverse Proxy Config Builder Write nginx or Caddy config for a self-hosted service, with TLS, WebSockets, and forwarded headers. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. nftables Rule Builder Generate nftables rules and a stateful starter ruleset for the inet filter table. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. tcpdump Filter Builder Assemble BPF capture filters by host, port, and protocol, with rotation and Wireshark output. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. GPG Command Builder Verify signed downloads, generate keys, and sign files or git commits without guessing flags. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. sudoers Rule Builder Write sudoers.d rules with run-as targets, NOPASSWD, and limited command lists, validated with visudo. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →