日本語English

SSH Config Studio

Paste your ~/.ssh/config to see the settings for each Host and the values that actually apply when you connect to a host name you choose. The first value found wins, so a Host * placed first hides later settings, and this tool flags that. It does not read Include files. To check how names resolve, use Hosts Studio.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Pasted text is processed only in your browser. It is not sent or stored. Key contents are not handled; only paths are shown.

Drop a config file

or

One text file, up to 200 KB. Contents are not sent anywhere.Paste (Ctrl+V) also works

Enter a name as written after Host in the file. Options given with ssh -o are not included.

Paste a ssh config or drop a file to see the settings for each Host.

How to use

  1. ssh config

    Paste ~/.ssh/config

  2. Findings and valuesfirst value wins

    Table per Host and findings

  3. Host blockno key contents

    Build a ProxyJump or key block

Paste ~/.ssh/config and check the values that apply to each host

  1. Paste the contents of your ~/.ssh/config. “Try a sample” loads an example with a bastion host and a misplaced Host * line.

  2. Enter a host name (for example web1) in “Host name”. The values that apply when you connect to that name are shown.

  3. In “Findings”, check old algorithms, StrictHostKeyChecking no, ForwardAgent yes on wide Host patterns, and settings hidden by an earlier one, each with its line number.

  4. In “Build”, enter the Host name, target, user, port, key path and ProxyJump to create a Host block. Copy it and add it to ~/.ssh/config.

What it does

First value wins

For a host name you enter, the first matching value is used, as in ssh_config(5). Keywords such as IdentityFile use every matching line.

Host pattern matching

Supports * and ? wildcards and ! exclusions (if any ! pattern matches, that line does not apply). Matching ignores letter case.

Findings by line

Flags settings hidden after Host *, StrictHostKeyChecking no, UserKnownHostsFile /dev/null, ForwardAgent yes on wide patterns, algorithms turned off by default in recent OpenSSH, and duplicate IdentityFile lines.

Key paths only

IdentityFile shows the path. There is no field for key contents, and a key pasted into the input is not used in the calculation.

Host block templates

Builds a Host block in ssh_config format from a Host name, target, user, port, key path and ProxyJump.

Use cases

  • Check how to write a Host that goes through a bastion with ProxyJump
  • Check whether a Host * line placed before the others hides their settings
  • Check whether an old algorithm such as ssh-rsa is still being used
  • Get a Host block template for a new server

Capability matrix

FeatureSupportNotes
Table per Host and Host *, and the values that apply to a host nameSupported—
Wildcard (* ?) and ! exclusion matchingSupported—
Line-numbered findings (hidden, risky, old algorithms, duplicates)Supported—
Host block templates (ProxyJump, port, key path)Supported—
Evaluating Match conditionsNot supportedShown as text, but the condition is not evaluated and its values are not counted as applying
Include (reading other files)Not supportedFiles are not read; only a finding is shown
Running ssh, checking key validity or resolving namesNot supportedNo network requests; ssh is not run
Checking the server-side sshd_configNot supportedOnly the client-side ~/.ssh/config is checked

Limits & notes

  • Input is limited to 200,000 characters and 5,000 lines. Anything beyond is not read, and you are told.
  • Command-line options (for example ssh -o) are not part of the calculation. They can override the values shown here.
  • Values inside Match blocks are shown as text only and are not counted as applying.
  • Old algorithms are flagged only if they were turned off by default in OpenSSH 7.0 or 8.8 release notes.

Privacy & safety

Pasted text is processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content.

FAQ

Which value is used when a keyword appears twice?
The first matching value is used. IdentityFile, CertificateFile, LocalForward, RemoteForward, DynamicForward and SendEnv are the exception: every matching line is used.
Where should Host * go?
After the specific Host blocks. Placed first, it sets the value for a keyword before the later specific blocks, and their setting for that keyword is ignored (ssh_config(5)).
How do I reach a server through a bastion with ProxyJump?
Add ProxyJump followed by the bastion’s Host name to the target’s Host block. The bastion needs its own Host block in the same file.
Is StrictHostKeyChecking no safe?
No. It skips the check of the server’s key on first connection, so a man-in-the-middle attack is easier. Combined with UserKnownHostsFile /dev/null, the record is not kept either. Use it only for a temporary test.
Why does ssh-rsa stop working?
OpenSSH 8.8 turned off RSA signatures that use SHA-1 (ssh-rsa) by default. Existing keys keep working with newer signature methods (such as rsa-sha2-256). Older servers may need +ssh-rsa in HostKeyAlgorithms or PubkeyAcceptedAlgorithms as a temporary workaround.

Crypto Studio — Hash, HMAC, Encryption & Keys

Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.

No upload

IP / CIDR / Subnet Calculator

Enter an IP address or CIDR to get the network, broadcast, usable host range and subnet mask instantly. Split networks (VLSM), convert ranges to CIDR and check IP lists — for both IPv4 and IPv6.

No upload

Hosts Studio

Paste a hosts file to see its IP and host name pairs in a table, with format errors, duplicates and changed localhost lines flagged by line number. It checks the syntax of hosts entries (IP, whitespace-separated names, # comments). It does not resolve names or write to your system. Save the output file and place it in the system hosts location with administrator rights.

No upload

.env Studio

Paste or drop a .env file to see its keys and values in a table, with duplicates, empty values and syntax problems flagged by line. Values are hidden by default. You can compare a .env with a .env.example, or export an example file, JSON or a Kubernetes Secret. It checks common dotenv syntax, not tool-specific rules such as docker compose variable expansion.

No upload

Apache Config Studio

Paste .htaccess, httpd.conf or a VirtualHost to see its section tree and line-numbered findings: unclosed sections, unknown directives and overly open settings. You can also generate HTTPS redirect, www and HSTS snippets.

No upload

Caddyfile Studio

Paste a Caddyfile to see its site blocks, snippets ((name) and import) and matchers (@name) as a tree, with line-numbered findings for unbalanced braces and undefined references. You can also make reverse proxy, static site, SPA and www redirect templates.

No upload

Last updated: