tool4.dev

Security / LOCAL TOOL

SSH Public Key Inspector

Decode OpenSSH public keys, fingerprints, comments, and authorized_keys options locally.

Runs locally — input is never uploaded
Paste an OpenSSH public key or authorized_keys line
ResultReady when you are

WHAT IT DOES

Identify the public key before granting it access.

Paste an OpenSSH public-key line or a complete authorized_keys entry to decode its embedded algorithm, key size, SHA-256 fingerprint, comment, and leading access options. The fingerprint is calculated from the original SSH wire-format blob with Web Crypto, matching the modern SHA256 form printed by OpenSSH. Private-key blocks are refused before decoding because an access-control review does not need the secret half of the key pair.

Why use it?

Use it to identify the key in an access request and review authorized_keys restrictions before granting access. Comments are labels, not proof of ownership.

How to use this tool

  1. Paste the public-key line, optionally including its authorized_keys options, and inspect it.
  2. Compare the calculated SHA256 fingerprint with a fingerprint obtained from the intended owner through a trusted channel.
  3. Review restrictions separately from the trailing comment. Changing a comment does not change the underlying key; this tool does not test whether anyone holds its private half.

Details and limitations

  • RSA, Ed25519, NIST P-256, P-384 and P-521 ECDSA, and OpenSSH FIDO/U2F public-key labels are recognized.
  • The outer key label is checked against the algorithm embedded in the Base64 blob so a mismatched or corrupted line is not accepted silently.
  • authorized_keys restrictions before the key type are preserved and reported separately from the free-form comment after the key.
  • Only public-key wire data is decoded; the tool does not connect to a host, query an agent, or verify that the corresponding private key exists.

COMMON QUESTIONS

SSH Key Inspector questions

Is the SHA-256 fingerprint compatible with ssh-keygen?
Yes. It hashes the decoded SSH public-key blob and displays the unpadded Base64 digest with the SHA256 prefix used by current OpenSSH.
Can I paste an authorized_keys line with restrictions?
Yes. Options such as from, command, no-pty, and restrict that appear before the key type are reported separately, while the comment after the key remains intact.
Can it inspect my private key?
No. Private-key PEM and OpenSSH blocks are refused. The public-key line contains everything needed to identify its algorithm and fingerprint without exposing secret key material.