# Ed25519 Key Generator

Generate an Ed25519 key pair for EdDSA signatures, SSH logins, signed Git commits and JWTs. You receive the private key as unencrypted PKCS #8 PEM, the public key as SPKI PEM, a ready ssh-ed25519 line for authorized_keys with an optional comment, its SHA-256 fingerprint and the RFC 7638 JWK thumbprint. Keys are created per request with Node's crypto module and are never logged or stored.

## Frequently asked questions

### Why use Ed25519?

Ed25519 offers about 128 bit security with 32 byte keys and 64 byte signatures, signs quickly and has no parameters to get wrong. Its signatures are deterministic, so a weak random generator at signing time cannot leak the key. It is the default key type of modern OpenSSH.

### What formats does the result use?

The private key is PEM encoded PKCS #8 (BEGIN PRIVATE KEY) and the public key is PEM encoded SubjectPublicKeyInfo (BEGIN PUBLIC KEY), as defined in RFC 8410. The public key is also given as an ssh-ed25519 line for OpenSSH.

### Can I use the private key with OpenSSH?

OpenSSH stores Ed25519 private keys in its own format, which this tool does not write, and many OpenSSH versions cannot load a PKCS #8 Ed25519 file. The ssh-ed25519 public line works in authorized_keys, but for an SSH identity file it is simplest to run ssh-keygen -t ed25519 on your own machine.

### Which JWT algorithm does the key sign?

Ed25519 keys sign the EdDSA algorithm defined in RFC 8037. Paste the private PEM into the JWT Generator with EdDSA selected, and give verifiers the public PEM or its JWK with kty OKP and crv Ed25519.

### What is the SHA-256 fingerprint in the result?

It is the fingerprint of the OpenSSH public key blob, written as SHA256: followed by unpadded base64, exactly as ssh-keygen -l and servers print it. Compare it with what a server or GitHub shows to confirm you added the right key.

### What is the JWK thumbprint?

The RFC 7638 thumbprint is the base64url SHA-256 hash of the key's crv, kty and x members. It identifies the key independent of format and is a convenient kid for JWTs and JWKS documents.

### Does the comment change the key?

No. The comment is only appended to the ssh-ed25519 line, for example you@laptop, so you can tell keys apart in authorized_keys. Fingerprints are computed from the key alone. Comments may have up to 200 characters.

### Is the private key encrypted?

No, it is returned without a passphrase. For storage, encrypt it with openssl pkey -in key.pem -aes256 -out key-encrypted.pem and keep the file readable only by you.

### Can I use Ed25519 for TLS certificates?

X.509 supports Ed25519 keys and OpenSSL can create such certificates and requests, but browsers and public certificate authorities do not accept them for TLS yet. For public TLS certificates use a P-256 key from the EC Key Generator or an RSA key.

### Is the generated key stored?

No. The key pair exists only in memory while your request runs and is returned once in the result. Nothing is logged or saved, so copy both keys before you leave the page.

Your ad here?

[Email us](mailto:hi@dennn.is?subject=Advertising%20on%20OneClick%20Pro)

[Ad The agent-ready plugin suite for WordPress.](https://sleekwp.com/?ref=oneclickpro)