Why pick Ed25519 over RSA?

Ed25519 keys are 32 bytes (vs 256+ for RSA), signing and verification are much faster, and the algorithm is deterministic and side-channel resistant. It's the default for modern SSH, age, Signal, and many JWT setups.

Can I use Ed25519 for encryption?

No. Ed25519 is a signature scheme only. For public-key encryption use X25519 (key exchange) combined with a symmetric cipher, or RSA-OAEP.

Where is the key generated?

In your browser, using the Web Crypto API's audited primitives and OS entropy. The private key is never transmitted.

ed25519 · web crypto · pem · local

Generate Ed25519 signing keys

Modern elliptic-curve signing keys — small, fast, side-channel resistant. Exports raw, hex, and PEM (SPKI / PKCS#8). Runs entirely in your browser.

Ed25519 Key Pair Generator

Curve

Ed25519

edwards

Public

—

Private

—

Status

idle

web crypto

input · controls

Click Generate keys to mint a fresh Ed25519 key pair. The browser uses Web Crypto's native generator — no external dependencies.

Ed25519 keys are 32 bytes public, 32 bytes private — much smaller than RSA at equivalent security.

Requires a recent Chromium- or Firefox-based browser. If you see an error, your browser is too old.

output · key pair

Click Generate to mint a key pair

Quick Start

How to generate an Ed25519 key pair

Ed25519 is the modern default for SSH keys, signed JWTs (EdDSA), and many APIs. Tiny, fast, and side-channel resistant.

01
Click Generate
Web Crypto mints a fresh pair without leaving your browser.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
generateUTF-8TextEncoderlosslesslive
alg · raw bytesEd25519 · UTF-8
```
generate pair
```
loaded · UTF-8MIME · ready
02
Export formats
Raw bytes (32 B), hex, PEM (SPKI for public, PKCS#8 for private).
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
formatWeb Cryptosubtledeterministiclive
out · optionsPEM · live
```
-----BEGIN PUBLIC KEY-----
```
options applied · livelive
03
Save the private key
Treat it like a password — never commit, never share.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
securememoisedoptionsinstantreactive
secret · encodedstore · ready
```
vault.set("…")
```
encoded · livelossless
04
Share the public key
Publish to authorized_keys, JWKS endpoints, or PGP-style fingerprints.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied public PEM
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to use Ed25519

SSH, signed JWTs (EdDSA), modern protocols.

SSH host & user keys

Default for new SSH installations since 2014. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

JWT signing (EdDSA)

Lighter than RSA, faster than ECDSA. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Code signing

Sign binaries, releases, and provenance records. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Cryptocurrency wallets

Many chains (Solana, Stellar) use Ed25519. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

TLS 1.3 certs

Optional EdDSA certificates. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Age / encryption identity

Used by the age file encryption tool. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

Why Ed25519 over RSA?

Same 128-bit security at 32 bytes (vs 3072-bit / 384-byte RSA), much faster, and side-channel resistant by design.

Can I use these keys for encryption?

Ed25519 is for signing only. For encryption use X25519 (different curve) or RSA-OAEP.

What is PKCS#8?

A standard wrapper for private keys. PEM-armored PKCS#8 is the OpenSSL default for non-RSA keys.

What is SPKI?

Subject Public Key Info — the standard public-key container in PEM/X.509 ecosystem.

Is anything sent to a server?

No. Keys are generated locally via Web Crypto — they never leave your browser, all runs locally.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!