Generate SSH keypairs whose public key contains a string of your choosing — visible to anyone who looks.
OpenSSH public keys are base64-encoded wire-format blobs. vanity-ssh generates keys at speed across all available threads until the base64 representation contains your target string, then stops. The private key is valid, unencrypted, and written in standard OpenSSH format. Nothing is backdoored. Nothing is weakened. It's just luck, parallelised.
Before searching, we benchmark key generation on your hardware for one second to give you an honest time estimate — not a guess.
git clone https://github.com/tomtastic/vanity-ssh
cd vanity-ssh
cargo build --releaseRequires Rust 1.75+.
vanity-ssh [OPTIONS] <pattern>
OPTIONS:
-t, --type <type> rsa1024 | rsa2048 | ed25519 [default: ed25519]
-i, --insensitive Case-insensitive matching
-j, --threads <n> Threads to use [default: all logical CPUs]
-c, --comment <text> Key comment field [default: vanity@ssh]
-o, --output <stem> Write to <stem> and <stem>.pub
-y, --yes Skip confirmation prompt
Pattern must be 5–20 characters and drawn from the base64 alphabet (A-Z, a-z, 0-9, +, /). Matching is case-sensitive by default.
# Find an ED25519 key containing your handle
vanity-ssh -o ~/.ssh/id_vanity M0RPH
# Case-insensitive RSA-2048, written to disk
vanity-ssh -t rsa2048 -i -o ~/.ssh/id_rsa_vanity ACME
# Print to stdout, skip the prompt
vanity-ssh -y CRYPT0The found key drops straight into ~/.ssh/ and works with any standard SSH toolchain — ssh, ssh-agent, GitHub, wherever.
| Pattern length | ED25519 (8 threads, ~500k/s) |
|---|---|
| 5 chars | ~30 seconds |
| 7 chars | ~2 hours |
| 9 chars | ~6 days |
| 11 chars | ~110 days |
RSA key generation is orders of magnitude slower. ED25519 is the only practical choice for patterns longer than 7 characters.
The tool will tell you all of this before you commit.
ED25519 — fast to generate, modern, recommended for any real use.
RSA-2048 — compatible with legacy systems. Slow to brute-force a vanity string into.
RSA-1024 — included for completeness. Considered cryptographically weak; do not use for anything that matters.
- The search is purely probabilistic. A match is never guaranteed, only increasingly likely.
- Generated private keys are unencrypted on disk. Protect them as you would any other private key (
chmod 600). - Nothing is transmitted anywhere. All generation happens locally.
MIT