{{ summaryHeading }} {{ summaryPrimary }} {{ summaryLine }} {{ summaryPath }} {{ summaryBits }} {{ summaryFingerprint }}
Prefer a public key line when possible. Private-key text and loaded files are never added to the share URL.
{{ sourceError }}
{{ fileStatus || 'Drop one PUB, PEM, KEY, or TXT file onto the textarea.' }}
Use one line of OpenSSH options. Review forced commands and source restrictions before installation.
Leave blank to preserve the public-line comment or omit it for private-key input.
SHA-256 remains visible and authoritative in both choices.
{{ report.public_key_line }}
{{ report.authorized_keys_line }}
FieldValueReview noteCopy
{{ row.field }}{{ row.value }}{{ row.review }}
Secure Shell (SSH) Public Key Converter Convert SSH public keys among OpenSSH, SSH2 and PEM locally while verifying key identity through matching SHA-256 fingerprints and safety checks.
PEM Bundle Extractor Split a PEM bundle into complete certificates, requests, and keys while preserving line spans and adding SHA-256 evidence through local file handling.
SSH Config Snippet Generator Build OpenSSH Host blocks from CSV inventory rows with inherited defaults and warnings for risky keys, jump hosts or connection sharing.
Secure Shell (SSH) Client Config Editor Edit an SSH client config locally, test Host wildcards, preserve Match and Include text, and flag risky or duplicate directives before use.

A missing .pub file does not necessarily mean an SSH identity is lost. SSH private-key containers carry the public material needed for authentication, and a public-key line can be rebuilt without creating a new key pair. The private key must still be handled as a secret throughout that recovery.

An OpenSSH public-key line has three practical parts: an algorithm name, a base64 encoding of the public-key blob, and an optional comment. The algorithm and blob define the cryptographic identity. The comment is only a human label, so changing alice@laptop to deploy@web01 does not change the key fingerprint.

  • Public key line is the shareable identity used by access requests and many SSH tools.
  • Fingerprint is a compact hash of the decoded public-key blob and is the safest field to compare with a trusted inventory.
  • authorized_keys entry may add server-enforced options before the public-key line.
  • Private key proves possession during login and must never be installed in authorized_keys.

Extraction is useful when restoring a missing public file, reviewing a key copied into a ticket, normalizing a comment, or preparing a restricted server entry. It does not prove that the destination server permits the algorithm, that the account belongs to the intended person, or that the options express a safe access policy.

A common failure is comparing visible text instead of identity. Whitespace and comments can differ while the underlying key stays the same. Conversely, two lines can carry the same comment while representing different keys. Compare the full SHA-256 fingerprint through an independent trusted channel before granting access.

Key size is meaningful only within the same algorithm family. A 256-bit Ed25519 key and a 2048-bit RSA key use different mathematics, so their bit counts are not a direct strength ranking.

How to Use This Tool:

Supply one trusted key source, confirm the derived identity, and only then prepare a server entry.

  1. Paste or load SSH key material. Supported sources include OpenSSH public-key lines, OpenSSH private-key containers, and unencrypted RSA private keys in PKCS #1 or PKCS #8 PEM form.
  2. Check Public key, Key type, Key size, and the SHA-256 fingerprint. If more than one supported key is detected, only the first supplies the result; split the source and retry with the intended key.
  3. Compare the full SHA-256 fingerprint with a trusted inventory, access request, or a separate ssh-keygen -lf check. Do not approve a key from its comment or base64 prefix alone.
  4. Add a Comment override only for a clearer human label. Add authorized_keys options only after reviewing the server policy; the options must remain on one line without control characters.
  5. Read Authorized entry as one physical line before copying it. If an encrypted PKCS #8 key is rejected, derive its public key with trusted local SSH tooling and supply the public line instead.

Interpreting Results:

Public identity ready means one supported public blob was decoded and normalized. First supported key extracted means additional supported keys were found but ignored. Neither status confirms server acceptance or ownership.

Use the SHA-256 fingerprint as the primary comparison. The optional MD5 fingerprint exists only for matching older records. An RSA key below 2048 bits receives a warning, but the destination's current algorithm and key-size policy remains authoritative.

The assembled Authorized entry is syntactically one line, not a policy audit. Review option names, quoted values, forced commands, forwarding restrictions, account ownership, and file permissions on the destination server before installation.

Technical Details:

SSH public keys are length-prefixed binary fields wrapped in a base64 token for line-oriented storage. The first field inside the decoded blob repeats the algorithm name. A mismatch between the visible algorithm and that embedded field is invalid because the line would claim one decoding rule while carrying another structure.

Transformation Core:

The public blob is the stable identity carried across source forms. Comments and server options are attached after decoding and do not participate in the fingerprint.

Source path Extraction rule Boundary
OpenSSH public line Decode the base64 token, verify its embedded algorithm, and preserve the first line's comment unless overridden. Up to 50 supported lines are detected; only the first becomes the result.
OpenSSH private container Read the unencrypted public-key section stored before the private payload. Up to 16 public entries are accepted; only the first becomes the result.
RSA private PEM Read the modulus and public exponent from unencrypted PKCS #1 or PKCS #8 DER and encode an ssh-rsa blob. Encrypted PKCS #8 and non-RSA private PEM inputs are not opened.
Fingerprint Hash the decoded public blob with SHA-256 and encode the digest as base64 without trailing padding. MD5 colon-hex output is optional and intended only for legacy comparison.
Authorized entry Place reviewed options before the normalized public line and apply the chosen comment. Options and comments must each stay on one line without control characters.
Algorithm Decoded public fields Reported bits
ssh-rsaPublic exponent and modulusSignificant modulus bits
ssh-ed2551932-byte Ed25519 public key256
ecdsa-sha2-nistp256Curve name and encoded public point256
ecdsa-sha2-nistp384Curve name and encoded public point384
ecdsa-sha2-nistp521Curve name and encoded public point521

The input is limited to 200,000 characters. The options field is limited to 1,000 characters and the comment override to 200 characters. Base64 syntax, length prefixes, complete field consumption, supported algorithm, curve-name agreement, and fixed Ed25519 key length are all checked before a result is produced.

An OpenSSH line is rebuilt from the decoded blob rather than copied blindly. That normalization removes irrelevant spacing while retaining the same key identity. The source path, blob size, and field byte counts offer an audit trail, but the fingerprint remains the most useful cross-system comparison.

Privacy and Security Notes:

Key material and selected files are processed in the browser and are not transmitted to a server by this extraction workflow. Local processing does not remove the risk of exposing a private key to the device, browser session, screen capture, clipboard history, or downloaded files.

  • Prefer a public-key line whenever it is available. Handle a private key only on a trusted device and clear the input when finished.
  • Never paste the derived public line back over the private-key file, and never send private material to the remote account.
  • Verify the installed key by fingerprint and test the intended login or forced command while a separate recovery session remains available.

References: