---
title: Ed25519 vs RSA: Which SSH Key Should You Use? | Relic
description: Ed25519 vs RSA for SSH keys and signatures: key sizes, performance, security margin, deterministic signing, compatibility, and the generation commands for each.
canonical: https://relic.space/blog/ed25519-vs-rsa
source: https://relic.space/llms.txt
---
[Developer cheat sheets](https://relic.space/blog/topics/dev-reference)

# Ed25519 vs RSA

For a new SSH key or signing key, Ed25519 is the better default: smaller keys, faster operations, and a design that sidesteps whole classes of RSA mistakes. RSA is still worth keeping for one reason, which is that some old or regulated systems will not accept anything else. This is the comparison, without the hand-waving.

[JGJordan Gibbs](https://relic.space/authors/jordan-gibbs) July 10, 2026 5 min readUpdated September 12, 2026

## Which is better, Ed25519 or RSA?

Pick Ed25519 for anything new. Its key is a fixed 256 bits, which reaches roughly the security of an RSA-3072 key, it signs and verifies faster, and it needs no random number at signing time. OpenSSH has supported it since version 6.5 in 2014\. Keep RSA for old or regulated systems that will not take anything else.

Both Ed25519 and RSA are public-key algorithms: you hold a private key, you hand out a public key, and the math links them so a signature made with the private key verifies against the public one. That is what lets an SSH server trust you without ever seeing your secret. The two differ in the kind of math underneath, and that difference shows up in key size, speed, and how easy each is to use safely.

## The recommendation

Generate **Ed25519** unless a specific system forces RSA on you. It is smaller, faster, and harder to misconfigure. Reach for RSA only when you hit a device, appliance, or compliance regime that predates Ed25519 support or will not accept it. If you do use RSA, use at least **3072 bits**, and prefer 4096 for long-lived keys.

## Side by side

|                           | Property                            | Ed25519                                           | RSA |
| ------------------------- | ----------------------------------- | ------------------------------------------------- | --- |
| Key size                  | Fixed 256-bit                       | 2048, 3072 or 4096-bit                            |     |
| Public key length (SSH)   | About 68 characters                 | About 400 to 750 characters                       |     |
| Security level            | About 128-bit                       | 2048-bit is about 112-bit; 3072-bit about 128-bit |     |
| Signing / verifying speed | Fast, constant time                 | Slower, key-size dependent                        |     |
| Key generation speed      | Near instant                        | Slow at 4096-bit                                  |     |
| Signatures                | Deterministic (no RNG at sign time) | Needs correct padding and randomness              |     |
| OpenSSH support           | Since 6.5 (2014)                    | Universal, including legacy systems               |     |
| FIPS / older HSM contexts | Sometimes unsupported               | Widely accepted                                   |     |

## Why is an Ed25519 key so much smaller than an RSA key?

RSA gets its strength from the difficulty of factoring a large number, so security scales with key length, and the keys get big. An RSA-3072 key is thousands of bits. Ed25519 is built on an elliptic curve (Curve25519), where the hard problem is steeper, so a fixed **256-bit** key reaches roughly the same security as RSA-3072\. That is the headline trade: a 256-bit Ed25519 key delivers what takes RSA about 3072 bits.

The practical upshot is a public key you can actually eyeball. An Ed25519 public key is around 68 characters, so the whole thing fits on one line of an authorized\_keys file. An RSA-4096 public key runs several hundred characters. Both work fine; the smaller one is just easier to handle and paste.

### Security margin, in plain numbers

Security levels are approximate, stated plainly. RSA-2048 sits around the [112-bit security level](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf), which is still considered safe today but sits right at the floor rather than a comfortable margin. RSA-3072 lands near 128-bit. Ed25519 is designed for roughly the **128-bit** level. So Ed25519 and RSA-3072 are in the same class, and RSA-2048 is a step below both. This is why 2048 is being phased out of higher-assurance guidance in favour of 3072 and up.

## Why are deterministic signatures safer?

This is Ed25519’s quiet advantage. Ed25519 signatures are [**deterministic**](https://www.rfc-editor.org/rfc/rfc8032.html): the signature is derived from the message and the private key alone, with no random number generated at signing time. That matters because a bad random number generator has historically broken signature schemes that depend on fresh randomness per signature. Ed25519 removes that failure mode entirely.

RSA works fine, but it has more sharp edges. RSA signing and encryption depend on choosing the right [padding scheme](https://www.rfc-editor.org/rfc/rfc8017.html), and older padding modes have well-documented weaknesses. None of this is a problem when you use a modern library correctly, but “used correctly” is doing real work in that sentence. Ed25519 gives you fewer knobs to set wrong. If the split between hiding data and proving identity is fuzzy, our explainer on [hashing vs encryption](https://relic.space/blog/hashing-vs-encryption) draws the line, and [what a hash function is](https://relic.space/blog/what-is-a-hash-function) covers the digest step that every signature is built on.

## When do you still need an RSA key?

OpenSSH has supported Ed25519 since version 6.5, released in early 2014, so any current Linux, macOS, or Windows OpenSSH client and server handles it. The gaps are at the edges: some older network appliances, certain hardware security modules, some Git hosting on dated software, and a few FIPS-constrained environments still expect RSA. If you administer a fleet that includes anything old or regulated, keeping an RSA key on hand costs nothing and saves a bad afternoon.

A useful rule: default to Ed25519 for your personal and server keys, and only generate RSA for the specific host that rejects it. There is no benefit to using RSA everywhere just because one box needs it.

## How do you generate an Ed25519 or RSA key with ssh-keygen?

The commands are nearly identical. For Ed25519, key size is fixed, so there is no length to specify.

Generate an Ed25519 key

ssh-keygen -t ed25519 -C "you@example.com"

For RSA, set the length yourself. The [ssh-keygen manual](https://man.openbsd.org/ssh-keygen) puts the default at 3072 bits and calls that generally sufficient, so ask for 4096 when you want more margin on a long-lived key.

Generate an RSA key

ssh-keygen -t rsa -b 4096 -C "you@example.com"

Both write a private key and a matching public key (the .pub file) into your \~/.ssh directory. You add the public key to the server; the private key never leaves your machine. Protect the private key with a passphrase at the prompt, and if you need a strong one, our [password generator](https://relic.space/tools/password-generator) produces one that runs entirely in your browser.

Your keys and secrets, in one searchable place.

Public keys, connection strings, and one-time tokens pile up across machines. Relic keeps everything you copy, searchable on every device and sealed with end-to-end encryption so only you can read it. The free plan holds 250 MB and 100 saved items across 3 devices.

[Download forWindows](https://relic.space/download/windows)[Download formacOS](https://relic.space/download/macos)[Download forLinux](https://relic.space/download/linux)[Download forAndroid](https://play.google.com/store/apps/details?id=relic.space.app&referrer=utm%5Fsource%3Drelic.space%26utm%5Fmedium%3Dwebsite%26utm%5Fcampaign%3Dcontent)[Download foriPhone](https://apps.apple.com/us/app/relic-clipboard-vault/id6800556025)

## The bottom line

Ed25519 wins on size, speed, and safety-by-default, and it is supported everywhere current. RSA earns its place only as the fallback for systems that will not take anything else, and when you use it, 3072 bits is the floor and 4096 the safer choice. Pick Ed25519 first, keep an RSA key for the stubborn hosts, and move on. For more references like this, the [regex cheat sheet](https://relic.space/blog/regex-cheat-sheet) and the rest of our [developer cheat sheets](https://relic.space/blog/topics/dev-reference) cover the other syntax you look up between the times you need it.

## Sources

* [RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA)](https://www.rfc-editor.org/rfc/rfc8032.html), RFC Editor (2017)
* [RFC 8017: PKCS #1 RSA Cryptography Specifications Version 2.2](https://www.rfc-editor.org/rfc/rfc8017.html), RFC Editor (2016)
* [SP 800-57 Part 1 Rev. 5: Recommendation for Key Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf), NIST (2020)
* [ssh-keygen(1) manual page](https://man.openbsd.org/ssh-keygen), OpenBSD

JG

Written by

[Jordan Gibbs](https://relic.space/authors/jordan-gibbs)Founder, Relic

Jordan Gibbs is the founder of Relic, an end-to-end encrypted, permanent, searchable memory for everything you copy. He writes widely about AI, agents, and practical tooling on Medium, where he is read by tens of thousands, and builds privacy-first software. Here he covers how everyday tools like the clipboard actually work, and how to use them without handing your data to someone else.

[Medium](https://medium.com/@jordan%5Fgibbs)[GitHub](https://github.com/jordan-gibbs)[LinkedIn](https://www.linkedin.com/in/jordan--gibbs/)

Part of

[Developer cheat sheets](https://relic.space/blog/topics/dev-reference)
* [Regex cheat sheet· pillar](https://relic.space/blog/regex-cheat-sheet)
* [How to copy and paste in Vim](https://relic.space/blog/how-to-copy-and-paste-in-vim)
* [How to copy to the clipboard from the command line](https://relic.space/blog/copy-to-clipboard-from-the-command-line)
* [What AI crawlers fetch from a small open-source site: 31 days of logs](https://relic.space/blog/ai-crawlers-on-a-small-site)
* [JSONPath examples](https://relic.space/blog/jsonpath-examples)
* [jq cheat sheet](https://relic.space/blog/jq-cheat-sheet)
* [wget vs curl: what is the difference?](https://relic.space/blog/wget-vs-curl)
* [Subnet cheat sheet](https://relic.space/blog/subnet-cheat-sheet)
* [Port numbers list](https://relic.space/blog/port-numbers-list)
* [TOML vs YAML](https://relic.space/blog/toml-vs-yaml)

Keep reading

[Pillar·10 minRegex cheat sheetThe regex pieces you actually reach for, character classes through lookarounds, with the flavor differences that bite you and a handful of patterns worth saving.Read ](https://relic.space/blog/regex-cheat-sheet)[9 minHow to copy and paste in Vimy copies and p pastes, but only inside Vim. How registers work, how to reach the system clipboard when your build says -clipboard, and how to copy out over SSH and in tmux.Read ](https://relic.space/blog/how-to-copy-and-paste-in-vim)[8 minHow to copy to the clipboard from the command linePipe any command into the clipboard on Mac, Linux, Windows and WSL. The commands for each, plus the newline and encoding problems that break pasted text.Read ](https://relic.space/blog/copy-to-clipboard-from-the-command-line)

developersecurityencryption