What this does
Parses an SSH public key — RSA, Ed25519, or ECDSA — entirely in your browser and shows what ssh-keygen -l would show: key type, bit length, SHA256 fingerprint, and the algorithm-specific details underneath (RSA's modulus size and public exponent, Ed25519's curve, ECDSA's NIST curve and signature hash). Verified byte-for-byte against real ssh-keygen output across every supported key type before shipping, and hardened against malformed or truncated input — a bad paste produces a clear error, never a frozen tab.
Why this only accepts public keys
A private key never needs to be pasted anywhere to answer "what type of key is this," "how long is it," or "what's its fingerprint" — every one of those is fully determined by the public half alone. This tool detects a pasted private key (anything starting with -----BEGIN ... PRIVATE KEY-----) and refuses it outright with an explanation, rather than silently accepting it. Treat that as a rule for any web tool, not just this one: a private key belongs on your machine and nowhere else.
Where to find the input this expects
- The contents of a
.pubfile —id_ed25519.pub,id_rsa.pub,id_ecdsa.pub— exactly as it comes out ofssh-keygenor SSH Key Generator. - A single line from a server's
~/.ssh/authorized_keys, if you're checking which key a line actually corresponds to. - A key from a Git hosting provider's "SSH keys" settings page, if you want to confirm its fingerprint matches what you expect.
What the fingerprint is for
The SHA256 fingerprint is a short hash of the exact key data — useful for confirming two copies of a key are genuinely identical, or for checking a fingerprint a server shows you against one you already trust, without comparing the entire base64 blob character by character. This matches ssh-keygen -l's default output format exactly.
Common mistakes
- Pasting the private key instead of the public one. They look superficially similar as blocks of base64/text, but only the file ending in
.pub(or explicitly labeled "public") is meant to be shared or pasted anywhere. - Pasting a whole authorized_keys file with several keys. This tool reads only the first key line it finds — check one key at a time.
- Expecting a bit length for Ed25519 to be a choice. It's always 256-bit by definition; unlike RSA, there's no size decision to inspect or make.
FAQ
Does this tell me if a key is safe to trust?
No — it tells you what the key is (type, size, fingerprint), not whether the person offering it should be trusted. Fingerprint verification is about confirming a key is the same one you expected, not about vouching for whoever holds the matching private key.
Can I check a key's validity without ssh-keygen installed?
Yes — that's the point of this tool: everything ssh-keygen -l would normally require a terminal for, running instead entirely in your browser.
Why does RSA show a bit length but Ed25519 and ECDSA don't vary?
RSA's security comes from choosing a large enough modulus, so its size is a real, variable property of the key. Ed25519 and each ECDSA curve are fixed-size by definition — inspecting one only confirms which fixed size it is, not a chosen parameter.
Try it yourself
Need to generate a key instead of inspect one? SSH Key Generator produces a real Ed25519 or RSA pair formatted exactly as OpenSSH expects. Read SSH Keys Explained for how the three algorithms actually differ under the hood, or SSH Config Generator to build the ~/.ssh/config block that points a host alias at this key.