How to use
Paste a public key (one line), or the contents of authorized_keys or known_hosts. “Try a sample” shows three keys and a weak RSA key.
In the table, check the type, bits, comment, SHA256 and MD5 fingerprint of each line.
Under “Points to watch”, check flags such as RSA under 2048 bits, option meanings and duplicate keys.
If you paste a private key (for example -----BEGIN OPENSSH PRIVATE KEY-----), its contents are not shown. Only whether it is encrypted and its public part are read.
For a new key, “Create key pair” makes Ed25519 (browsers that support it) or ECDSA P-256. Save the public and private key from there.
What it does
SHA256 and MD5 fingerprints
Shows SHA256 in the same form as ssh-keygen -lf (without the trailing =) and MD5 colon-separated. Both are computed on your device.
Type and bits
Reads ssh-ed25519, ssh-rsa, ECDSA (P-256, P-384, P-521) and security keys whose type starts with sk-. ssh-dss (DSA) is shown as disabled by default in OpenSSH.
authorized_keys options
Lists command=, from=, no-port-forwarding and other options as defined in sshd(8), with explanations. Unknown options are flagged as a warning.
known_hosts lines
Handles hashed host names (|1|) and @revoked or @cert-authority lines. A key that appears in more than one line is reported as a duplicate.
Key creation
Creates Ed25519 and ECDSA P-256 key pairs with Web Crypto and writes them in OpenSSH format (PROTOCOL.key). The private key is not encrypted, and ssh-keygen -p can add a passphrase later.
Use cases
- Check the type and fingerprint of a public key before adding it to an authorized_keys file
- Find out what command=, from= or no-port-forwarding in an authorized_keys line restricts
- Check the fingerprint of a key in known_hosts, including hashed host names
- Create an Ed25519 or ECDSA key and save it in OpenSSH format
Supported formats
Input
Output
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Public key type, bits, SHA256 and MD5 fingerprints | Supported | — |
| authorized_keys lines and option explanations | Supported | — |
| known_hosts lines (including hashed host names) | Partial | A hashed host name cannot be turned back into the original host name |
| Contents of certificates (-cert-v01@openssh.com) | Not supported | Only the type is shown. Validity and signatures are not read |
| Showing private-key contents, or decrypting with a passphrase | Not supported | Private-key contents are not shown and nothing is decrypted |
| Whether a private key is encrypted | Partial | OpenSSH format is judged from its header. For PEM formats (such as RSA) only the encryption flag is checked |
| Creating RSA or DSA keys | Not supported | For RSA, use ssh-keygen -t rsa -b 3072 |
| Registering a key on a server or testing a connection | Not supported | No server is contacted |
| Deciding whether a key belongs to the right person | Not supported | The fingerprint format is checked, but trust must be confirmed separately |
Limits & notes
- Up to 1,000,000 characters and 2,000 lines of input.
- Ed25519 creation works only in browsers that support it in Web Crypto. Otherwise ECDSA P-256 is created.
- Created private keys are not encrypted. After saving, set permissions with chmod 600, and add a passphrase with ssh-keygen -p if needed.
- Fingerprints and key creation happen on your device. The tool does not judge whether a key is safe overall.
Privacy & safety
What you paste and the keys you create are handled entirely in your browser. Nothing is sent to or stored on a server. Private-key contents are hidden by default, and saving happens only when you choose it.
FAQ
How do I check the fingerprint of an SSH public key?
What do the options on an authorized_keys line mean?
How many bits of RSA are considered too few?
What happens if I paste a private key?
How do I create an SSH key?
How do I check an ssh configuration file?
Related tools
SSH Config Studio
Paste your ~/.ssh/config to see the settings for each Host and the values that actually apply when you connect to a host name you choose. The first value found wins, so a Host * placed first hides later settings, and this tool flags that. It does not read Include files. To check how names resolve, use Hosts Studio.
Crypto Studio — Hash, HMAC, Encryption & Keys
Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.
JWK / JWKS Studio — Inspect Keys & Convert to PEM
Paste a JWK or JWKS to get a table of each key’s type, kid, size and thumbprint, with every problem explained against RFC 7517 and 7518. You can also convert a key to PEM. This tool does not verify signatures or generate keys.
Certificate, CSR & PEM Studio
Reads PEM, DER (.cer/.crt), CSR and PKCS#7 (.p7b) and lists the subject, expiry (days left), SANs, public key, signature algorithm and SHA-256 fingerprint. It also checks chain order and signatures and converts PEM and DER. Everything runs in your browser and private keys are never read.
TOTP Studio (2FA Code Checker)
For developers testing two-factor authentication: compute TOTP and HOTP codes from a secret, and build or read otpauth:// URIs and QR codes. Everything runs with Web Crypto in your browser; the secret is never sent or stored.
ASN.1 / DER Viewer
Reads PEM, Base64, hex or a DER file and shows the ASN.1 TLV structure (tag, length, value) as a tree. Common OIDs get their names, and wrong lengths or non-DER encodings are flagged. Private-key values are hidden with a warning, and nothing is sent.
Last updated: