Choose Ed25519 when the destination supports it
Ed25519 avoids a key-size decision and produces compact public keys. It is a strong default for current OpenSSH clients, but destination support still decides whether you should use it. Keep an existing key until the new public key has been installed and verified.
Choose the destination container
| Format | Use it for | Guidance |
|---|---|---|
| OpenSSH | Current SSH clients | Recommended for SSH clients |
| PKCS#8 | Java and general crypto tooling | Algorithm-neutral container |
| PuTTY PPK v3 | Current PuTTY software | Normal PuTTY choice |
| PuTTY PPK v2 | Older PuTTY destinations | Legacy compatibility only |
PKCS#1 is an RSA-only format, so it is never offered for Ed25519. Changing Ed25519 to RSA would create a different identity and is therefore a new generation operation rather than conversion.
Generate and verify locally
- Confirm that the destination accepts Ed25519.
- Choose the container used by the destination.
- Add a passphrase unless a managed automation workflow requires an unencrypted key.
- Download the private key and restrict access to the file.
- Record the public-key fingerprint before installing it.
The Local Dev Kit generator and converter run in the browser. Generate, Convert, Diagnose, Copy, Download, and Clear do not send key material to the application server.
Ed25519 SSH key questions
Should I choose Ed25519 for a new SSH key?
Choose Ed25519 when the destination supports it. It is compact, fast, and needs no key-size decision. Check the destination documentation before replacing an existing identity.
Can an Ed25519 key be converted to RSA?
No. Converting a container keeps the same algorithm and identity. Use Generate to create a separate RSA identity when a destination requires RSA.
Which Ed25519 private-key format should I use?
Use OpenSSH for modern SSH clients, PKCS#8 for Java and general cryptographic tooling, or PuTTY PPK v3 for current PuTTY. Use PPK v2 only for an older destination that requires it.