# SSH Key Decoder

> Decode an SSH public key line and read its key type, size, comment and fingerprint.

- Page: https://decoder.tools/ssh-key-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

An SSH key decoder parses a public key line such as `ssh-ed25519 AAAAC3Nza… user@laptop` and reports the algorithm, the key size, the comment and the fingerprint that `ssh` shows when you connect.

## Example

```text Input
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINChqVkT1234567890abcdefGHIJKLMNopqrstuvwx user@laptop
```

```text Output
Algorithm:   ssh-ed25519
Key size:    256-bit
Comment:     user@laptop
SHA256 fingerprint: SHA256:cgLAmxIS2gKYJ9zYsZgtrjHqtecTb1gPglqsFnpM690
Type: ssh-ed25519
Key size: 256-bit
Fingerprint: SHA256:cgLAmxIS2gKYJ9zYsZgtrjHqtecTb1gPglqsFnpM690
Comment: user@laptop
```

## The public key format

An OpenSSH public key line has three space-separated parts:

```text
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI… user@laptop
```

1. **Key type**: `ssh-ed25519`, `ssh-rsa`, `ecdsa-sha2-nistp256`, `sk-ssh-ed25519@openssh.com` (hardware key) and so on.
2. **Key blob**: Base64 of a binary structure (RFC 4253). It begins with the type name again, followed by the key's numbers, for example the exponent and modulus for RSA.
3. **Comment**: free text, usually `user@host`. It's not part of the key.

The **fingerprint** is a hash of the decoded blob. Modern OpenSSH shows it as `SHA256:` plus Base64. Older tools show MD5 hex pairs (`aa:bb:…`).

## How to use the SSH key decoder

1. Paste a public key line (`ssh-ed25519 AAAA… comment`), or open a `.pub` file or an OpenSSH private key.
2. Read the algorithm, key size, comment and the `SHA256:` fingerprint that `ssh` shows on first connect.
3. For a private key, the decoder reports whether it is encrypted — an unencrypted private key is usable by anyone who has the file.

`ssh-keygen` shows the same fingerprint on the command line:

```sh Command line
# Type, size, fingerprint and comment
ssh-keygen -l -f ~/.ssh/id_ed25519.pub
# 256 SHA256:… user@laptop (ED25519)

# Fingerprint in the old MD5 format
ssh-keygen -l -E md5 -f ~/.ssh/id_ed25519.pub

# Fingerprints of every key in authorized_keys
ssh-keygen -l -f ~/.ssh/authorized_keys
```

## Key types at a glance

| Type | Notes |
|---|---|
| `ssh-ed25519` | Recommended default. Small, fast, fixed 256-bit |
| `ssh-rsa` | Use 3072 bits or more. SHA-1 signatures are disabled in OpenSSH 8.8+ |
| `ecdsa-sha2-nistp256/384/521` | NIST curves. Fine, but Ed25519 is usually preferred |
| `sk-…@openssh.com` | Backed by a FIDO2 hardware key |

## FAQ

### Is it safe to share my SSH public key?

Yes. It's designed to be shared and placed in `authorized_keys` on servers. Never share the private key file (`id_ed25519` without `.pub`).

### How do I check a server's host key fingerprint?

Run `ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub` on the server, or `ssh-keyscan host | ssh-keygen -lf -` from elsewhere, and compare it with what `ssh` shows on first connect.

### Why does ssh-rsa fail on new servers?

OpenSSH 8.8 disabled the `ssh-rsa` signature algorithm, which uses SHA-1. RSA keys still work with `rsa-sha2-256` and `rsa-sha2-512`, but very old clients and servers may not support those. Switching to Ed25519 avoids the problem.