One source.
Many possibilities.
Explore SSH key pairs, hexadecimal and other secret encodings, UUIDs, authenticator setups and ASCII seed art. Everything is generated locally in this tab.
Cameras + browser randomness.
No keys sent to a server.
No saved session or history.
Cameras + browser.
Every generator uses the same sampler as dice, coins, cards and runes. Each generation asks for a fresh sample. Browser randomness is always included. Requiring a camera stops generation when no image is available; unchecking it allows a labeled fallback.
Ready. A fresh sample is requested for each generation.
The portable HTML reads the same public sampler at www.kamala.pro. Browser only works without a network connection.
Generate an SSH key pair.
A new generation replaces the current pair. Download the private key before starting another pair.
The private key is exported directly to a file and is never displayed on the page.
Keep the passphrase separately from the private key.
Which file goes where?
The public .pub file goes to the server or service account. The private file stays on the computer used to connect. Both files belong to the same fingerprint.
For SSH, choose OpenSSH for both files. Place them in the SSH directory, restrict the private file and install only the public key on an authorized server. Replace USER@HOST with the intended account and host.
PEM and JWK exports are for applications that request those containers.
One value, several representations.
Create random bytes and explore how the same value looks as hexadecimal, Base64, Base64url or Base32. UUID v4 is also available as a separate identifier format.
Changing between encodings keeps the same bytes. Switching to or from UUID requires a new generation; its version and variant leave 122 random bits. Encoding changes the representation, not the amount of randomness.
Explore a TOTP setup.
Create a new shared secret and QR for an authenticator. The target service must accept that same setup secret before the displayed codes can be used to sign in.
HMAC-SHA1 · 6 digits · 30 seconds · device clock. Keep a recovery copy before enabling two-factor authentication in the target service.
------Make a random seed artwork.
This creates a separate random pattern from a fresh sample. It does not reveal or reuse the private seed of an SSH key.
Generation and privacy details
Key pairs, secrets, TOTP setups and artwork each ask for a fresh sample from the shared camera, server and browser source. Browser cryptographic randomness is added. Ed25519 derives its pair from mixed bytes; RSA prime candidates use the same byte provider. Public or repeated camera images do not replace local cryptographic randomness, and no physical entropy rate has been established for the cameras. The ASCII artwork comes from an independent sample and never displays a key's private seed.
There are no analytics or persistent browser storage in this workspace. The SSH QR contains the public key. Secret and TOTP QR codes contain their labeled secret values and transfer them when scanned. Private SSH keys download as files. Clear removes displayed values and releases session references; downloaded files and clipboard contents remain under browser and operating-system control. JavaScript cannot guarantee removal of every memory copy. The portable download includes all four tools and makes only a credential-free request for the shared public sample.