SSH Key & authorized_keys Analyzer
Read SSH public keys, certificates and authorized_keys lines: type, size, fingerprints, certificate details and a numbered security ruleset. Private keys are refused.
Runs in your browser Your input never leaves your device.
Paste public keys only (the .pub file or an authorized_keys file). If a private key is pasted by mistake it is skipped and never read or shown. Nothing is uploaded.
Findings
Keys
What is checked
DSA keys, RSA size (under 1024, under 2048, under 3072) and unusual public exponents; certificate expiry, never-expiring and long-lived certificates, missing principals, weak or DSA signing CAs and default permissive extensions; authorized_keys options: no from= restriction, from=* , forced commands that start a shell or sudo, a forced command without restrict, environment=, cert-authority lines, no-touch-required on security keys, unknown options (typos), and repeated keys. It does not check whether a key is in a known-leaked list, who holds the private key, or the server's sshd_config.
Keys are parsed in your browser. Fingerprints use the same formats as ssh-keygen -l (SHA256, and MD5 for old tools). Findings describe the text you pasted, not your servers.
Report a problem with this tool
About this tool
An authorized_keys file or a folder of .pub files tells you who can log in to a machine, and old or loose entries are a common finding in reviews. This tool reads public keys in your browser and shows what ssh-keygen would show, plus a review. For every line it parses the OpenSSH format: the optional options field (including quoted values that contain commas and escaped quotes), the key type (RSA, DSA, ECDSA on the three NIST curves, Ed25519, and the security-key types sk-ssh-ed25519 and sk-ecdsa), the key data and the comment. It reports the key size or curve, the SHA256 fingerprint in the form ssh-keygen -l prints, the older MD5 fingerprint, and for security keys the application string. SSH certificates are decoded fully: user or host type, key ID, serial, principals, validity period, critical options such as force-command and source-address, extensions, and the signing CA's type, size and fingerprint. ECDSA points are checked to be on their curve. A numbered ruleset of 17 checks flags DSA keys, RSA keys under 2048 bits (and a note under 3072), unusual public exponents, expired, not-yet-valid, never-expiring and long-lived certificates, certificates with no principals, weak or DSA signing CAs, lines that trust a certificate authority, keys with no from= restriction or from=*, forced commands that start a shell or sudo, forced commands without restrict, environment= options, unknown options that are probably typos, security keys marked no-touch-required, and repeated keys. It does not check leaked-key lists, who holds the private key, or your server's sshd_config. If a private key is pasted by mistake, the whole block is skipped without being read or shown. Fingerprints, sizes, certificate fields and the accept or reject decision for damaged keys were compared with ssh-keygen on real RSA, DSA, ECDSA, Ed25519 keys and user and host certificates. Nothing is uploaded.
How to use it
- Paste one or more public keys, or an authorized_keys file, or load a file.
- Read the findings first, then the details of each key: fingerprints, certificate fields and options.
- Compare the SHA256 fingerprint with what the owner sees from ssh-keygen -l.
- Copy the Markdown summary into your notes or report.
Common problems
- A line says it could not be read
- The message names the reason: unknown key type, bad base64, key data cut short, a curve point that is not valid, or a missing key type. Copy the whole line including the key type word.
- My private key was skipped
- That is intended. Paste only the public key (the .pub file). If the private key was ever pasted somewhere shared, replace it.
- The fingerprint of a certificate looks like the plain key's
- It is. Like ssh-keygen -l, the fingerprint shown is that of the public key inside the certificate. The signing CA has its own fingerprint in the certificate details.