How to make an SSH key on a Chromebook, with or without Linux

If your Chromebook has the Linux development environment, open its Terminal and run ssh-keygen -t ed25519; that is the standard route and needs nothing else. If Linux is not available, which is common on school and work Chromebooks where the administrator has switched it off, you can make an OpenSSH key pair in the browser with SSHKEY, which uses the browser’s own cryptography and writes the same files ssh-keygen does, then import the private key into Google’s Secure Shell extension or give the public key to GitHub. The private key is made in the tab and stays on your Chromebook.

With the Linux environment

1. Open Settings → About ChromeOS → Developers (on older versions, Settings → Advanced → Developers) and turn on the Linux development environment. It downloads a Debian container; allow a few minutes.
2. Open the Terminal app and run ssh-keygen -t ed25519 -C "you@chromebook". Accept the default file, ~/.ssh/id_ed25519, and choose a passphrase.
3. Show the public key with cat ~/.ssh/id_ed25519.pub and copy the one line it prints to GitHub (Settings, SSH and GPG keys) or to the server’s ~/.ssh/authorized_keys.
4. Connect with ssh user@host from the same Terminal.

If the Developers section is missing or the switch is greyed out, your administrator has disabled Linux, and the route below is the one open to you. Developer mode, which some guides suggest, wipes the Chromebook and is not available at all on a managed one.

Without Linux

ChromeOS has no terminal of its own for SSH, but Google publishes the Secure Shell extension in the Chrome Web Store, which connects over SSH from a browser tab and accepts imported identity files. What it does not have is a command to generate a key. So the key has to be made somewhere and imported.

1. Open SSHKEY, choose Ed25519, type a comment and a passphrase, and make the key pair.
2. Save the private key and the .pub file to the Chromebook’s Downloads folder, or anywhere you can reach from the Files app.
3. Copy the public key line and add it to GitHub, GitLab, or the server’s authorized_keys.
4. In Secure Shell’s connection dialogue, use Import beside the identity list and choose both files; the extension keeps a copy of them. Then pick that identity when connecting.

Keep the private key off shared drives and cloud folders; anyone with the file and the passphrase can sign in as you. That is why the passphrase matters on a Chromebook shared at school or at home.

What SSHKEY actually makes

The key is generated by WebCrypto’s generateKey, the browser’s built-in cryptography, which draws on the operating system’s random number generator. SSHKEY then writes the private key in OpenSSH’s own format (the file beginning -----BEGIN OPENSSH PRIVATE KEY-----), locked with your passphrase by bcrypt_pbkdf and AES-256 as ssh-keygen locks it, and the public key as the single line ssh-ed25519 AAAA… comment, with its SHA256 fingerprint shown so you can compare it with what GitHub or the server displays. Nothing about the key is sent anywhere, and nothing is kept once the tab is closed.

Ed25519 in WebCrypto needs a recent browser: Chrome and Edge 137 or later, Firefox 129, Safari 17. A Chromebook on current ChromeOS has it. On an older one the list starts at ECDSA, which works with GitHub and almost every server; RSA at 3072 bits or more is there for old systems that accept nothing else.

Making the key and seeing its fingerprint is free. Saving the key files is part of OBSCURA Pro, or US$1 to save from one tool for a day; on a Chromebook with Linux, ssh-keygen costs nothing, and we would use it.

Check the fingerprint

When you add the public key to GitHub it shows a SHA256 fingerprint; so does SSHKEY, and so does ssh-keygen -lf on the file. They should match. The first time you connect to a server, it shows you the server’s fingerprint in turn, which is the one to check against what the server’s owner publishes. How to check an SSH key fingerprint covers both directions.