decoder.tools

SSH Key Decoder

Decode an SSH public key line and read its key type, size, comment and fingerprint.

Security, PKI & CryptoFree
INPUT

Or drop a file here: a .pub public key or an OpenSSH private key file

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

An SSH key decoder parses a public key line such as ssh-ed25519 AAAAC3Nza… user@laptop and reports the algorithm, the key size, the comment and the fingerprint that ssh shows when you connect.

Example

Input
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINChqVkT1234567890abcdefGHIJKLMNopqrstuvwx user@laptop
Output
Algorithm:   ssh-ed25519
Key size:    256-bit
Comment:     user@laptop
SHA256 fingerprint: SHA256:cgLAmxIS2gKYJ9zYsZgtrjHqtecTb1gPglqsFnpM690
Type: ssh-ed25519
Key size: 256-bit
Fingerprint: SHA256:cgLAmxIS2gKYJ9zYsZgtrjHqtecTb1gPglqsFnpM690
Comment: user@laptop

The public key format

An OpenSSH public key line has three space-separated parts:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI… user@laptop
  1. Key type: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, sk-ssh-ed25519@openssh.com (hardware key) and so on.
  2. Key blob: Base64 of a binary structure (RFC 4253). It begins with the type name again, followed by the key's numbers, for example the exponent and modulus for RSA.
  3. Comment: free text, usually user@host. It's not part of the key.

The fingerprint is a hash of the decoded blob. Modern OpenSSH shows it as SHA256: plus Base64. Older tools show MD5 hex pairs (aa:bb:…).

How to use the SSH key decoder

  1. Paste a public key line (ssh-ed25519 AAAA… comment), or open a .pub file or an OpenSSH private key.
  2. Read the algorithm, key size, comment and the SHA256: fingerprint that ssh shows on first connect.
  3. For a private key, the decoder reports whether it is encrypted — an unencrypted private key is usable by anyone who has the file.

ssh-keygen shows the same fingerprint on the command line:

Command line
# Type, size, fingerprint and comment
ssh-keygen -l -f ~/.ssh/id_ed25519.pub
# 256 SHA256:… user@laptop (ED25519)

# Fingerprint in the old MD5 format
ssh-keygen -l -E md5 -f ~/.ssh/id_ed25519.pub

# Fingerprints of every key in authorized_keys
ssh-keygen -l -f ~/.ssh/authorized_keys

Key types at a glance

TypeNotes
ssh-ed25519Recommended default. Small, fast, fixed 256-bit
ssh-rsaUse 3072 bits or more. SHA-1 signatures are disabled in OpenSSH 8.8+
ecdsa-sha2-nistp256/384/521NIST curves. Fine, but Ed25519 is usually preferred
sk-…@openssh.comBacked by a FIDO2 hardware key

Frequently asked questions

Is it safe to share my SSH public key?

Yes. It's designed to be shared and placed in authorized_keys on servers. Never share the private key file (id_ed25519 without .pub).

How do I check a server's host key fingerprint?

Run ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub on the server, or ssh-keyscan host | ssh-keygen -lf - from elsewhere, and compare it with what ssh shows on first connect.

Why does ssh-rsa fail on new servers?

OpenSSH 8.8 disabled the ssh-rsa signature algorithm, which uses SHA-1. RSA keys still work with rsa-sha2-256 and rsa-sha2-512, but very old clients and servers may not support those. Switching to Ed25519 avoids the problem.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown