Should I use Ed25519 or RSA?

Ed25519 unless something in your fleet can't handle it. It is faster, has small fixed-size keys, and removes the key-size question entirely. If you must use RSA, use 4096 bits.

What is the comment at the end of the key?

A free-text label, conventionally user@hostname. OpenSSH ignores it for authentication — it exists purely so humans can tell keys apart in an authorized_keys file.

How do I compute an SSH fingerprint myself?

ssh-keygen -lf key.pub prints it. Modern OpenSSH shows SHA-256 in Base64; the older MD5 colon-separated form is deprecated.

Is it safe to share a public key?

Yes — that is its purpose. The corresponding private key is the secret, and nothing about it can be derived from the public half.

SSH Key Decoder

Decode SSH public key blobs and read their algorithm, size and fingerprint.

on the roadmapSecurity, PKI & Cryptofree · no sign-up

This bench is being wired up

The ssh-key-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the SSH Key Decoder?

An SSH key decoder parses the Base64 blob inside an OpenSSH public key line, revealing the key algorithm, its parameters and the fingerprint that servers and clients use to identify it.

An OpenSSH public key line has three parts: the algorithm name (ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256), a Base64 blob, and an optional comment that is usually a user@host label with no security meaning. Inside the blob is a length-prefixed structure that repeats the algorithm name and then carries the key material itself — the modulus and exponent for RSA, the curve point for ECDSA and Ed25519.

Two things are worth checking on any key you inherit. First the algorithm and size: Ed25519 is the modern default, RSA below 3072 bits is weak, and DSA is obsolete and disabled in current OpenSSH. Second the fingerprint — the SHA-256 hash of the blob, which is what you compare against a known-good value before trusting a host or approving a deploy key.

Only ever decode public keys. A private key is a credential and belongs nowhere near a web page, including this one.

SSH Key Decoder at a glance

Format: algorithm base64-blob comment
Modern default: ssh-ed25519 — small, fast, no size tuning
Fingerprint: SHA-256 of the raw key blob, Base64-displayed
Private keys: Never paste them into any online tool

How to use the SSH Key Decoder

1Paste one public key line from authorized_keys, known_hosts or a .pub file.
2Read the algorithm, key parameters and computed fingerprint.
3Compare the fingerprint with the value you were given out of band.

When you would reach for it

Auditing an authorized_keys file for weak or obsolete key types.
Matching a key in a Git host's settings to the one on a build machine.
Verifying a host key fingerprint before accepting a first connection.

SSH Key Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools