{{ summaryHeading }} {{ summaryFingerprint }} {{ summaryLine }} {{ verdictLabel }} {{ keyTypeLabel }} {{ sourceLabel }}
Auto resolves the first supported public key. Pin a format to reject other wrappers.
One key is processed. Extra key-like lines are ignored and reported.
{{ inputError }}
{{ fileStatus || 'Drop one PUB, PEM, TXT, or DER public-key file onto the editor.' }}
A match identifies the same key bytes; it does not prove the reference source or hostname is trustworthy.
Hashed, wildcard, and negated host patterns cannot become SSHFP owner names.
Copies the canonical SHA256 value for an independent comparison channel.
{{ include_sha1 ? 'Legacy SHA-1 output included' : 'SHA256 and MD5 only' }}
Default off; enable only for a legacy inventory or SSHFP workflow.
{{ uppercase_md5 ? 'Uppercase hex pairs' : 'Lowercase hex pairs' }}
Display-only compatibility setting; digest comparison remains case-insensitive.
{{ strict_mode ? 'Plain OpenSSH line required' : 'Wrapper detection allowed' }}
Default off; enable to reject host fields, key options, and block wrappers.
FieldValueMeaningCopy
{{ row.field }}{{ row.value }}{{ row.meaning }}
PrioritySignalEvidenceNext actionCopy
{{ row.priority }}{{ row.signal }}{{ row.evidence }}{{ row.next_action }}
ArtifactValueUseCopy
{{ row.artifact }}{{ row.value }}{{ row.use }}
SSH Config Snippet Generator Build OpenSSH Host blocks from CSV inventory rows with inherited defaults and warnings for risky keys, jump hosts or connection sharing.
Prompt String 1 (PS1) Generator Build or import a Bash PS1 prompt with ordered tokens and safe ANSI styling plus a terminal preview and setup text for real-shell testing.
Secure Shell (SSH) Public Key Converter Convert SSH public keys among OpenSSH, SSH2 and PEM locally while verifying key identity through matching SHA-256 fingerprints and safety checks.
Secure Shell (SSH) Public Key Extractor Extract a supported SSH public key locally, verify its SHA-256 fingerprint, and assemble a reviewed authorized_keys entry from key material.

The first connection to an unfamiliar SSH server creates a trust decision before authentication can safely finish. The server presents a public host key, and the client displays a short fingerprint derived from that key. Accepting it without an independent comparison can attach the hostname to an attacker’s key just as easily as to the intended server.

A fingerprint is a digest of the canonical SSH public-key blob. The algorithm name, Base64 key data, and binary fields determine it. A comment at the end of an OpenSSH public-key line and a hostname at the start of a known_hosts line provide context, but they are not included in the key digest.

Format Common appearance Use
SHA-256 SHA256: followed by unpadded Base64 Modern OpenSSH display and the preferred human comparison.
MD5 MD5: followed by colon-separated hexadecimal bytes Compatibility with old prompts and inventories, not a preferred new trust record.
SHA-1 SHA1: Base64 or a hexadecimal digest Legacy inventory or SSHFP workflows when a stronger digest is unavailable.

Matching fingerprints prove that two observations contain the same public-key bytes. They do not prove that the reference came from the server owner, that the hostname is correct, or that the current network path is safe. The reference should come through a separate trusted channel such as a server console, configuration inventory, deployment record, or administrator.

Host keys and user keys have different jobs. A host key identifies the server to the client; a user public key identifies an account holder to the server. Both can be fingerprinted, but matching a user key does not authenticate a host, and collecting a host key with ssh-keyscan does not make that key trustworthy by itself.

Key family still matters after identity is confirmed. Ed25519 and current ECDSA keys have compact, well-defined public blobs. RSA strength depends on modulus size, while short RSA keys and DSA keys deserve replacement or explicit legacy handling. A strong algorithm cannot rescue a fingerprint obtained from an untrusted reference channel.

Changed host keys require investigation, not automatic replacement. A legitimate rebuild or rotation can change the fingerprint, but so can connecting to the wrong machine or an interception point. Verify the hostname, port, key type, and change record before updating known_hosts.

How to Use This Tool:

Use one public key and one independently obtained fingerprint for the clearest trust decision.

  1. Choose Input format or leave it on automatic detection. Paste an OpenSSH line, a known_hosts line, an RFC 4716 SSH2 block, or a supported PEM public-key block.
  2. Paste the trusted value into Expected fingerprint. SHA-256 Base64 or hex, MD5 colon-hex or plain hex, and SHA-1 Base64 or hex are recognized.
  3. Add a concrete Host label when you want a prepared known_hosts line or SSHFP record. A hashed, wildcard, or negated host pattern cannot become an SSHFP owner.
  4. Enable Include SHA-1 only for a legacy inventory or SSHFP requirement. Uppercase MD5 changes display only; comparisons remain case-insensitive.
  5. Use Strict OpenSSH line when host fields, key options, block wrappers, and other prefixes must be rejected.
  6. Read Trust decision first. Stop on a mismatch, investigate parser or key-strength warnings, and accept the key only after the hostname and reference channel are also verified.

Interpreting Results:

Reference matched means at least one recognized expected digest equals the digest of the parsed key blob. Reference mismatch means none match and the key should not be accepted. Reference unclear means the supplied text was not recognized as a supported fingerprint, while No reference means identity was calculated but not independently confirmed.

  • Compare key type and host context as well as the digest. A correct fingerprint attached to the wrong hostname is still the wrong trust decision.
  • Treat a type mismatch between the outer text and inner key blob as suspicious input.
  • Review RSA keys below 2,048 bits, all DSA keys, malformed Ed25519 lengths, and OpenSSH certificate objects before long-lived use.
  • Prepared known_hosts and SSHFP rows are artifacts for review. Publishing or installing them is a separate privileged action.

Technical Details:

An SSH public-key fingerprint is computed over the binary key blob, not over the visible wrapper. That blob begins with a four-byte length and the key-type string, followed by algorithm-specific fields such as an RSA exponent and modulus, an ECDSA curve and point, or a 32-byte Ed25519 public value.

Transformation Core:

Stage Transformation Failure or warning condition
Wrapper parse Recover the key type and Base64 or DER-encoded public material from the selected format. Unsupported type, malformed Base64, truncated block, or unsupported PEM algorithm.
Canonical blob Decode or rebuild the SSH length-prefixed binary fields. Outer type differs from the type stored inside the blob.
Digest Hash the same canonical blob with SHA-256 and MD5; compute SHA-1 for optional legacy output. None when parsing succeeded; display format does not alter digest bytes.
Reference comparison Normalize supported Base64, hex, and colon-hex forms, then compare without case sensitivity. Unrecognized expected text cannot confirm identity.

The canonical modern display is SHA256: plus the SHA-256 digest encoded as Base64 without trailing padding. MD5 is rendered as colon-separated hexadecimal bytes. Hashing the full text line would be wrong because comments, host fields, spacing, and wrapper formats may change while the key blob remains identical.

Automatic detection uses the first supported key found. Strict mode requires the key type at the beginning of an OpenSSH line. Private-key blocks, PuTTY private-key files, and X.509 certificate containers are rejected; only public-key material is accepted. Input is limited to 65,536 characters.

Rule Core:

Condition Result Required response
Any recognized expected digest matches Pass Still confirm the hostname and reference provenance.
Recognized expected digests are present but none match Stop Do not accept the key; verify rotation and endpoint identity separately.
Ed25519 or security-key Ed25519 Strong profile when structurally valid Confirm the public value is 32 bytes.
ECDSA with a supported 256-, 384-, or 521-bit NIST curve Strong profile Keep curve and key type aligned with the trusted record.
RSA at least 3,072 bits Strong profile Record the modulus size with the inventory.
RSA 2,048 to 3,071 bits Accepted profile Plan according to the organization’s cryptographic lifecycle.
RSA below 2,048 bits or DSA Review Replace weak or deprecated key material.

SSHFP records encode an algorithm number and fingerprint type. The supported raw-key mappings are RSA = 1, DSA = 2, ECDSA = 3, and Ed25519 = 4. SHA-1 uses fingerprint type 1 and SHA-256 uses type 2. A concrete hostname and a supported raw host key are required; wildcard, negated, or hashed host fields are not valid owner names.

The default Ed25519 sample parses as a 256-bit key and produces SHA256:rAyYVxT5urrNq0zLN1sLjSgfzVOQs93F1po2tHQd/sI. Matching that sample value demonstrates byte identity only; it does not turn the demonstration key into a trusted host key.

Privacy Notes:

Public-key parsing, digest calculation, and comparison stay in the current browser. The pasted key and expected fingerprint are not sent to a server by this checker.

  • Private keys are deliberately rejected. Never paste private-key material into a fingerprint checker.
  • A public key is not secret, but hostnames, comments, and inventory labels can reveal infrastructure details.
  • The generated remote-scan command contacts the named host only if you choose to run it in your own shell; it is not executed here.
  • Publishing an SSHFP record exposes a fingerprint through DNS and should use the organization’s reviewed DNSSEC workflow.

References: