Ed25519 Key Generator
Generate Ed25519 signing key pairs in your browser via Web Crypto — fast, modern, and private.
What is Ed25519?
Ed25519 is a modern elliptic-curve signature scheme based on the Edwards-curve Diffie-Hellman function over Curve25519, designed by Daniel J. Bernstein and colleagues. It is notable for its small key size (32 bytes each), fast signing and verification, and resistance to side-channel attacks. Ed25519 is widely used in SSH (OpenSSH's preferred key type since 6.5), TLS 1.3, JWT (OKP keys), and secure messaging protocols. Browser support arrived in Chrome 113 (May 2023), Firefox 119 (October 2023), and Safari 17 (September 2023). Keys are exported in standard SPKI (public) and PKCS#8 (private) formats encoded as PEM, compatible with OpenSSL and Node.js. All computation runs entirely in your browser via the Web Crypto API — no data is transmitted.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Producing a modern signing key pair for SSH or a signature scheme.
- Generating a test key for a verification path.
- Producing a key where speed and small size matter more than legacy support.
- Producing a key for an SSH host or user where the smaller public key is the point.
- Replacing an ageing RSA key with a modern equivalent.
Frequently Asked Questions
- What makes Ed25519 different from RSA or ECDSA?
- It is EdDSA over Curve25519 — a specific curve chosen for speed and for having no parameter choices to get wrong. Keys are 32 bytes, signatures 64, and it is fast enough that the performance argument for weaker options disappears entirely.
- Why is it considered safer to implement?
- Because the signature is deterministic — it derives its nonce from the message and the key rather than from a random source. That removes the failure mode that has broken ECDSA repeatedly, where a repeated or predictable nonce leaks the private key outright.
- Should I use it for SSH?
- Yes, where the server supports it — `ssh-keygen -t ed25519` has been the recommended default for years. The public key is short enough to fit on one line comfortably, and OpenSSH has supported it since 6.5 in 2014.
- Can Ed25519 be used for encryption?
- Not directly — it is a signature algorithm. The encryption counterpart on the same curve is X25519, used for key agreement. They share the underlying curve and are not interchangeable, which is why a library exposes both under different names.
- Where is support still missing?
- Some enterprise and hardware ecosystems, and older TLS stacks. Browser support through Web Crypto arrived late and unevenly, which is why a tool generating one has to check for it rather than assume. Where it works, there is little reason to choose anything else.
Common errors and gotchas
- Expecting to choose a curve or a key size, when Ed25519 fixes both by design.
- Assuming universal support, since some older systems and HSMs still accept RSA only.
- Confusing signing with key exchange, where the X25519 counterpart is the one for exchange.
- Expecting a configurable key size, when the curve fixes it by design.
- Assuming an SSH server accepts it, since very old OpenSSH builds do not.