# SSH Key Studio

Paste an ssh-ed25519, ssh-rsa or ecdsa-sha2-nistp256 public key, or lines from authorized\_keys or known\_hosts. The type, bits and fingerprints appear (SHA256 in the same form as ssh-keygen -lf, MD5 colon-separated). Private-key contents are never shown; you are warned to paste public keys only.

- URL: https://tools.itlibra.com/en/ssh-key-studio
- On-device・No upload
- Last updated: 2026-10-31

## How to use

1. Paste a public key (one line), or the contents of authorized\_keys or known\_hosts. “Try a sample” shows three keys and a weak RSA key.
2. In the table, check the type, bits, comment, SHA256 and MD5 fingerprint of each line.
3. Under “Points to watch”, check flags such as RSA under 2048 bits, option meanings and duplicate keys.
4. If you paste a private key (for example -----BEGIN OPENSSH PRIVATE KEY-----), its contents are not shown. Only whether it is encrypted and its public part are read.
5. For a new key, “Create key pair” makes Ed25519 (browsers that support it) or ECDSA P-256. Save the public and private key from there.

## Use cases

- Check the type and fingerprint of a public key before adding it to an authorized\_keys file
- Find out what command=, from= or no-port-forwarding in an authorized\_keys line restricts
- Check the fingerprint of a key in known\_hosts, including hashed host names
- Create an Ed25519 or ECDSA key and save it in OpenSSH format

## What it does

### SHA256 and MD5 fingerprints

Shows SHA256 in the same form as ssh-keygen -lf (without the trailing =) and MD5 colon-separated. Both are computed on your device.

### Type and bits

Reads ssh-ed25519, ssh-rsa, ECDSA (P-256, P-384, P-521) and security keys whose type starts with sk-. ssh-dss (DSA) is shown as disabled by default in OpenSSH.

### authorized\_keys options

Lists command=, from=, no-port-forwarding and other options as defined in sshd(8), with explanations. Unknown options are flagged as a warning.

### known\_hosts lines

Handles hashed host names (\|1\|) and @revoked or @cert-authority lines. A key that appears in more than one line is reported as a duplicate.

### Key creation

Creates Ed25519 and ECDSA P-256 key pairs with Web Crypto and writes them in OpenSSH format (PROTOCOL.key). The private key is not encrypted, and ssh-keygen -p can add a passphrase later.


## Supported formats

### Input

- Public key (one line)
- authorized\_keys
- known\_hosts
- Private key (only the header is read)

### Output

- Table of types and fingerprints
- Public key (.pub)
- Private key (created, not encrypted)


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Public key type, bits, SHA256 and MD5 fingerprints | Supported | — |
| authorized\_keys lines and option explanations | Supported | — |
| known\_hosts lines (including hashed host names) | Partial | A hashed host name cannot be turned back into the original host name |
| Contents of certificates (-cert-v01@openssh.com) | Not supported | Only the type is shown. Validity and signatures are not read |
| Showing private-key contents, or decrypting with a passphrase | Not supported | Private-key contents are not shown and nothing is decrypted |
| Whether a private key is encrypted | Partial | OpenSSH format is judged from its header. For PEM formats (such as RSA) only the encryption flag is checked |
| Creating RSA or DSA keys | Not supported | For RSA, use ssh-keygen -t rsa -b 3072 |
| Registering a key on a server or testing a connection | Not supported | No server is contacted |
| Deciding whether a key belongs to the right person | Not supported | The fingerprint format is checked, but trust must be confirmed separately |

## Limits & notes

- Up to 1,000,000 characters and 2,000 lines of input.
- Ed25519 creation works only in browsers that support it in Web Crypto. Otherwise ECDSA P-256 is created.
- Created private keys are not encrypted. After saving, set permissions with chmod 600, and add a passphrase with ssh-keygen -p if needed.
- Fingerprints and key creation happen on your device. The tool does not judge whether a key is safe overall.

## Privacy & safety

What you paste and the keys you create are handled entirely in your browser. Nothing is sent to or stored on a server. Private-key contents are hidden by default, and saving happens only when you choose it.

## FAQ

### How do I check the fingerprint of an SSH public key?

Paste the public key line, which starts with ssh-ed25519 AAAA… or similar. The SHA256 and MD5 fingerprints are shown. The SHA256 form matches the output of ssh-keygen -lf.

### What do the options on an authorized\_keys line mean?

command=, from=, no-port-forwarding and the other options are explained per line, following the definitions in sshd(8).

### How many bits of RSA are considered too few?

Under 2048 bits is flagged as weak. 2048 to 3071 bits is shown as a caution. For a new key, Ed25519 is common.

### What happens if I paste a private key?

Its contents are not shown. Only whether it is encrypted and its public part are read. Do not share the private key, and create a new key if it may have leaked.

### How do I create an SSH key?

Choose Ed25519 or ECDSA P-256 to create one. The output is in OpenSSH format and can be read by ssh-keygen. RSA keys are not created here.

### How do I check an ssh configuration file?

Use SSH Config Studio (ssh\_config\_studio) for ssh\_config and sshd\_config files. This tool handles keys only.