{{ summaryHeading }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }} {{ badge.value }}
Conversion is browser-local. The key text is excluded from shareable URL state.
{{ inputFeedback }}
Auto resolves the wrapper from markers or the SSH key line. Choose a pinned format to reject another wrapper.
Output choice expresses intent, so it is never auto-selected from the input wrapper.
Comments can disclose account or infrastructure context; review before sharing.
Use 40-72 characters. This setting does not change the canonical key blob.
characters 
{{ values.output_text }}
FieldValueMeaningCopy
{{ row.field }}{{ row.value }}{{ row.meaning }}
CheckStatusEvidenceCopy
{{ row.check }}{{ row.status }}{{ row.evidence }}
Secure Shell (SSH) Public Key Extractor Extract a supported SSH public key locally, verify its SHA-256 fingerprint, and assemble a reviewed authorized_keys entry from key material.
Secure Sockets Layer (SSL) Certificate Converter Convert PEM/DER/P7B/PFX certificates in your browser and inspect chain expiry plus private-key requirements before downloading.
PEM Bundle Extractor Split a PEM bundle into complete certificates, requests, and keys while preserving line spans and adding SHA-256 evidence through local file handling.
RSA Keys Converter Rewrap an existing RSA key for PKCS#1, PKCS#8 or SPKI consumers with optional encrypted output and local public-identity checks.

An SSH public key can be represented by several text formats without changing the cryptographic identity underneath. OpenSSH commonly uses one line containing a key type, base64 data, and an optional comment. RFC 4716 uses an SSH2 block with markers and wrapped body lines. PEM places a DER-encoded public key inside a different pair of markers.

Format differences matter when a server, appliance, cloud console, or library accepts only one wrapper. A key copied from the wrong source may be rejected even though its public values are valid. The safe aim is therefore to rewrite the wrapper while keeping the algorithm and public values unchanged.

Public key
The shareable half of a key pair. It cannot replace the matching private key.
Key blob
The SSH binary representation that carries the key type and public values.
Fingerprint
A short digest of the key blob used to compare identity across wrappers.
Comment
A human label such as a device or account name. Changing it does not change the key.

Fingerprints are more dependable than filenames, comments, or visual comparison. Line wrapping and comments may legitimately change during conversion, while the SHA-256 fingerprint should remain the same. A matching fingerprint proves that two wrappers contain the same public key bytes; it does not prove who owns the key, where it is authorized, or whether the private key is still secure.

Keep private keys out of conversion forms and tickets. If only a private-key file remains, derive its public key on a trusted machine first. Certificates and OpenSSH certificate objects are also different containers and should not be mistaken for raw public keys.

How to Use This Tool:

Start with one public key and choose the wrapper required by the destination.

  1. Paste the public key into Public key or browse for a public-key file. If the source contains several keys, reduce it to the intended one before conversion.
  2. Leave Input format on Auto detect for a normal OpenSSH line, SSH2 block, or PEM public key. Pin the format when the surrounding text is ambiguous.
  3. Choose Output format. Use OpenSSH for a one-line key, RFC 4716/SSH2 for a marked block, or PEM when a system asks for a generic public-key envelope.
  4. Set Comment override only when a new human label is needed. For SSH2 output, keep SSH2 body wrap between 40 and 72 characters.
  5. Review Key evidence and Conversion checks. Compare the SHA-256 fingerprint with a trusted source before copying the converted key.

Interpreting Results:

The SHA256 fingerprint is the main identity check. It is calculated from the canonical SSH key blob, so it stays stable across OpenSSH, SSH2, and PEM output. The colon-separated MD5 fingerprint is present for legacy comparison only and is not current cryptographic-strength guidance.

  • Confirm that Key type, key size or curve, and SHA-256 fingerprint match the expected identity.
  • Treat an extra-key warning as a reason to inspect the source. Only the first public-key item is converted.
  • Do not read a successful conversion as an authorization check. Test the key against the intended account or compare it with a trusted inventory.
  • Stop if the key family is unsupported, the outer and inner key types disagree, or a private-key or certificate marker appears.

Technical Details:

SSH key conversion begins by decoding the source wrapper into one binary SSH public-key blob. That blob is parsed again to confirm the embedded algorithm and public values. Output is then serialized from those same values rather than by generating a new key pair.

Transformation Core:

Stage Exact behavior Verification
Read Accept an OpenSSH line, RFC 4716 block, PEM PUBLIC KEY, or PEM RSA PUBLIC KEY. Reject private-key and certificate containers before parsing.
Decode Recover the SSH key type and its public fields from the canonical blob. Require the type inside the blob to agree with any type written outside it.
Serialize Write OpenSSH, SSH2, and SubjectPublicKeyInfo PEM forms from the same public values. RSA, Ed25519, and NIST P-256, P-384, and P-521 ECDSA are convertible.
Compare Calculate SHA-256 and legacy MD5 fingerprints from the SSH blob, not from wrapper text. The SHA-256 fingerprint must identify every generated wrapper.

OpenSSH output joins the algorithm name, base64-encoded blob, and optional comment on one line. SSH2 output wraps the same blob between RFC 4716 markers and limits body lines to the selected width. PEM output encodes the public values as SubjectPublicKeyInfo: RSA uses its modulus and exponent, Ed25519 uses its 32-byte public value, and ECDSA uses the named NIST curve and point.

Rule Boundary or effect
Source size At most 65,536 characters; empty input is rejected.
SSH2 body width Whole numbers from 40 through 72 characters, inclusive.
Comment Line breaks and repeated spaces are collapsed, then the text is limited to 160 characters. PEM carries no comment.
RSA warning RSA keys shorter than 2,048 bits are parsed with a review warning.
DSA and security-key types They may be recognized as SSH objects, but conversion to all three output wrappers is unsupported.
Multiple items The first public-key item is used and the remaining count is reported as ignored.

The SHA-256 fingerprint uses base64 without trailing padding and the familiar SHA256: prefix. Presentation changes such as comments and SSH2 line wrapping do not enter that digest, which is why fingerprint equality is the right round-trip invariant.

Privacy and Safety Notes:

The key is parsed and converted in the browser; no server-side converter receives it. Public keys are meant to be shared, but comments can reveal usernames, hostnames, email addresses, or internal asset names.

  • Never paste a private key. Private-key markers and PuTTY private-key files are rejected, but the safest practice is not to load them at all.
  • Compare the result with a fingerprint obtained from a trusted source, not only with another copy of the same untrusted text.
  • Keep the original public-key file until the converted form has been accepted and tested by the destination.

Worked Examples:

Ed25519 line to PEM

A one-line ssh-ed25519 key with a 32-byte public value resolves to a 256-bit Ed25519 identity. Choosing PEM writes a BEGIN PUBLIC KEY block, while its SHA-256 fingerprint remains identical to the OpenSSH source.

Copied block with extra keys

A paste containing two public keys converts only the first item and reports one ignored item. The correct response is to isolate the intended key and rerun the conversion, then compare its fingerprint with the trusted inventory.

References: