Secure Shell (SSH) Public Key Converter

Field	Value	Copy
{{ row.label }}	{{ row.value }} {{ row.value }}
Warnings	{{ w }}
Error	{{ single.error }}

Type	Bits/Curve	SHA256	Comment	Copy
{{ r.typeLabel }}	{{ r.bits }} {{ r.curve }} —	{{ r.sha256 }}	{{ r.comment \|\| '' }}
No rows.

Secure Shell public keys are identity tokens that prove possession of a corresponding private key during connection setup, and they travel well across systems when encoded correctly. Many teams need a quick way to convert a key between common formats and confirm the fingerprint that other tools display, so everyone can compare the same string with confidence.

Here you paste a public key and receive its fingerprints plus clean equivalents in OpenSSH, SSH2 Public Key, and PEM forms. The result helps you match what is printed on servers, configuration notes, or audit logs without touching any private material.

Typical uses include verifying a newly provisioned key before rollout, rewrapping a key for systems that expect PEM, or sharing a short fingerprint when confirming access with a colleague. Keep inputs consistent, and prefer copying directly from a known source to avoid stray whitespace.

If a block contains several items and you only want one, process a single line first to confirm the fingerprint, then switch to batch when you are ready. Public keys are safe to share, yet treat them carefully in shared documents so they do not get truncated or reformatted.

Technical Details:

The underlying object is a Secure Shell (SSH) public key. The tool observes the algorithm family and key material, then computes two identifiers on the canonical SSH key blob. It finally renders equivalent encodings for OpenSSH one‑line format, SSH2 Public Key blocks defined in RFC 4716, and a PEM SubjectPublicKeyInfo (SPKI) wrapper.

Computation begins by parsing the SSH key blob to recover the algorithm label and its parameters. From that byte sequence, two fingerprints are produced so operators can cross‑check identities across hosts and tooling without exposing private data.

\begin{array}{l} F_{SHA256} (B) & = & Base64 without padding of SHA‑256 over B \\ F_{MD5} (B) & = & Hex bytes of MD5 over B, grouped with colons \end{array}

Symbols and units
Symbol	Meaning	Unit/Datatype	Source
B	SSH key blob bytes after type and parameters are packed	bytes	Derived
F_SHA256	Primary fingerprint shown as “SHA256: …”	Base64, no padding	Derived
F_MD5	Legacy fingerprint for compatibility displays	Hex pairs with “:” separators	Derived
n, e	RSA modulus and public exponent	BigInt	Parsed
c	Elliptic curve name (nistp256, nistp384, nistp521)	string	Parsed
Q	Uncompressed EC public point	bytes	Parsed
type	Algorithm label (RSA, ECDSA, Ed25519)	string	Parsed

Worked example. An OpenSSH line is parsed into its blob B, then fingerprints are computed. The SHA256 value is shown as “SHA256: <base64‑no‑pad>”. The MD5 value is rendered as colon‑separated hex pairs. The same blob yields OpenSSH text, an SSH2 block with an optional Comment: header, and a PEM “PUBLIC KEY” wrapper.

Comparability notes: fingerprints match common host tools when the same blob is used. For ECDSA, bits are implied by c and reported as 256, 384, or 521. For RSA, bit length is taken from the modulus n. Ed25519 always reports 256.

Algorithmic pipeline

Detect input family: OpenSSH one‑line, SSH2 block, PEM SPKI, or PKCS#1 RSA public key.
Decode base64 or ASN.1 as required to recover the SSH blob B.
Parse B to identify type and parameters (n,e or c,Q or Ed25519 key).
Compute SHA‑256 and MD5 over B, format as display strings.
Re‑emit OpenSSH, SSH2, and PEM encodings from the parsed parameters.
Attach the original or overridden comment to OpenSSH and SSH2 outputs.

Inputs & validation

Validation and bounds defined by the implementation
Field	Type	Min	Max	Step/Pattern	Error Text / Behavior
OpenSSH line	text	—	—	`^(ssh-rsa\|ssh-ed25519\|ecdsa-sha2-[a-z0-9-]+)\s+[A-Za-z0-9+/=]+`	Unknown input format → parse error; `ssh-dss` is not accepted.
SSH2 block	text	—	—	Begins `---- BEGIN SSH2 PUBLIC KEY ----`	Optional `Comment: "..."` supported; body is base64 only.
PEM SPKI	text	—	—	`-----BEGIN PUBLIC KEY-----`	RSA, Ed25519, and ECDSA nistp256/384/521 are recognized.
PEM PKCS#1 RSA	text	—	—	`-----BEGIN RSA PUBLIC KEY-----`	Parsed as modulus/exponent and converted to SSH formats.
SSH2 wrap column	number	40	128	step 1	Applied to SSH2 body lines; PEM wraps at 64 by design.
Comment override	text	—	—	Plain text	Replaces detected comment on OpenSSH and SSH2 outputs.
Batch mode	bool	—	—	Detects multiple items	Optional de‑duplication collapses identical SHA256 fingerprints.

I/O formats

Accepted inputs and produced outputs
Input	Accepted Families	Output	Encoding / Precision	Notes
Text	OpenSSH line, SSH2 block, PEM PUBLIC KEY, PKCS#1 RSA PUBLIC KEY	OpenSSH · SSH2 · PEM	Exact re‑emit from parsed parameters	Comments preserved or overridden as configured.
File	.pub · .pem · .txt; drag‑and‑drop .der/.cer supported	Same as above	Binary DER is wrapped to PEM then parsed	Private keys are rejected.
Fingerprint	—	SHA256 · MD5	Base64‑no‑pad; colon‑hex	Both computed over the SSH blob.

Networking & storage

Processing is browser based; no data is transmitted to a server. Files and text are handled locally, and outputs are generated on the page. No server‑side retention occurs.

Security considerations

Only public keys should be pasted; private keys are refused by design.
MD5 exists for legacy comparisons and should not be used to make trust decisions.
Always verify fingerprints out‑of‑band before granting access.

Assumptions & limitations

Supported types: RSA, ECDSA nistp256/nistp384/nistp521, and Ed25519.
Heads‑up DSA (ssh-dss) is not supported.
Only SSH2 Public Key blocks per RFC 4716 are recognized, not SSH certificates.
PEM inputs must be PUBLIC KEY or RSA PUBLIC KEY; EC PUBLIC KEY is not accepted.
ECDSA curves outside the three listed will fail conversion to PEM.
SSH2 wrap width applies to SSH2 only; PEM always wraps at 64 characters.
Comments are treated as plain text and are not validated.
Bit length for RSA is derived from modulus size and may differ from nominal labels.

Edge cases & error sources

Base64 with embedded spaces is cleaned; non‑base64 characters are dropped.
Malformed SSH2 headers or missing footer will cause a parse error.
PEM with unused bits in BIT STRING is rejected by ASN.1 rules.
Unknown algorithm OIDs in SPKI cause an error.
ECDSA curves other than nistp256/384/521 are treated as unsupported.
Truncated OpenSSH base64 blobs cannot be recovered.
Multiple items in single mode ignore extras; use batch to process all.
Overlong comments are preserved and may wrap in displays.
Very large RSA moduli increase processing time but remain deterministic.
Non‑UTF‑8 comment bytes may display differently across platforms.

Privacy & compliance

No data is transmitted or stored server‑side. Public keys are not confidential, yet handle them according to your organization’s policy.

Step‑by‑Step Guide

Public key conversion and fingerprinting, from paste to verified outputs.

Paste a single public key into the input Required.
Select Parse to analyze the key.
Open Advanced to enable batch or set a comment.
Adjust SSH2 wrap width if a specific line length is required.
Copy the OpenSSH, SSH2, or PEM output you need.
Compare the SHA256 string with the value shown on your target system.

Example: Paste an OpenSSH line, confirm the SHA256 prefix matches your host, then copy the PEM form for a service that expects SPKI.

You now have consistent encodings and fingerprints ready for review or deployment.

FAQ

Is my data stored?

No. Processing happens in the browser. Nothing is sent to a server or retained beyond your session.

Public keys only; private keys are refused.

Which key types are supported?

RSA, ECDSA on nistp256/nistp384/nistp521, and Ed25519. DSA is not supported.

What does “Unknown input format” mean?

The text did not match OpenSSH, SSH2 Public Key, PEM PUBLIC KEY, or PKCS#1 RSA PUBLIC KEY patterns. Check headers, footers, and base64.

How accurate are the fingerprints?

They are deterministic for a given key blob and align with common host tools that show SHA256 without padding and MD5 as colon‑hex.

Can I convert PEM to OpenSSH?

Yes. Paste a PEM PUBLIC KEY; the OpenSSH and SSH2 outputs are produced from the parsed parameters.

Does it work offline?

Yes. It runs locally in your browser after the page loads.

What about cost or licensing?

No usage limits are shown here. Consult your organization’s policies before distributing generated outputs.

How do I validate a CSR?

Certificate signing requests are outside scope. Extract the public key first, then paste that here to inspect fingerprints and encodings.

Troubleshooting

Nothing happens after paste: click Parse to start analysis.
Multiple items pasted: enable Batch mode to process all.
Duplicates in batch: turn on de‑duplication to keep the first instance.
PEM fails: ensure it is PUBLIC KEY or RSA PUBLIC KEY, not a private key.
SSH2 lines too long: decrease the wrap width to 64 or 70.
Curve unsupported: use a key on nistp256, nistp384, or nistp521.

If you pasted a private key, remove it immediately. This tool rejects private keys and does not process them.

Glossary

OpenSSH format: One‑line type, base64 key blob, and optional comment.
SSH2 Public Key: Headered text block with optional quoted comment per RFC 4716.
PEM PUBLIC KEY: SPKI wrapper around algorithm and key material.
Fingerprint: Short identifier derived from a key blob.
Modulus / exponent: RSA parameters that determine size and strength.
Curve: Elliptic set used by ECDSA, e.g., nistp256.
Comment: Human note attached to OpenSSH and SSH2 encodings.

Secure Shell (SSH) Public Key Converter

SSH Public Key

Introduction:

Technical Details:

Algorithmic pipeline

Inputs & validation

I/O formats

Networking & storage

Security considerations

Assumptions & limitations

Edge cases & error sources

Privacy & compliance

Step‑by‑Step Guide

FAQ

Troubleshooting

Glossary