01
Copy the public line without its wrapper
Use the type, Base64 body and optional comment from a .pub file. Remove hostnames or authorization options yourself; a known_hosts line and a PEM block have different structures.
Hash & Crypto Helpers
SSH key inspectorRead the key behind the comment
Paste one OpenSSH public key, or add a second to compare. Never paste a private key.
SSH key inspector
Public keys only. Inputs stay in this page’s memory; nothing is uploaded or saved to browser storage.
Key details and fingerprints
Enter a public key to inspect.
A blank second field inspects one key. Fingerprint copy buttons use the first key; the JSON report contains both.
One OpenSSH line per field, up to 16,384 UTF-16 units. Structural inspection only; MD5 and DSA are for legacy records.
Enter a public key to inspect.
SSH key inspector helps when two public-key files have different names or comments and you need to know whether they contain the same key. The label at the end of a line is not part of its fingerprint.
Use this SSH public key parser to inspect a copied .pub line before checking a deployment inventory. A matching key identifies the same public bytes; it does not establish who controls the corresponding private key.
Why use this SSH key inspector?
Compare keys, including differently labelled copies
SSH key inspector decodes both inputs before comparing their complete wire blobs. An email address, a machine label or surrounding whitespace can change without changing the key. The example deliberately uses one public key with two comments.
Catch broken fields before trusting a digest
Base64 decoding alone cannot tell you whether a public key is complete. Length prefixes, internal type names and algorithm-specific fields are checked before any fingerprint is returned. A truncated blob produces an error rather than a plausible identifier.
Check the right bytes
02
Use the second field to resolve duplicates
Changing only the comment should still report a match. The SHA256 and MD5 copy buttons target the first key; the JSON report includes both keys and the comparison.
03
Choose when the report refreshes
Automatic parsing waits 350 ms after an edit. Turn it off to use the button or Ctrl/Cmd+Enter. Old exports are disabled immediately; Example and Clear can be previewed, applied and undone once.
Public fields and reproducible identifiers
Read algorithm-specific parameters
Inspect RSA exponent and modulus, Ed25519 public bytes, DSA p/q/g/y, or ECDSA curve and point. RSA length comes from the modulus; Ed25519 shows 256 encoded bits. Equal bit counts across algorithms do not imply equal security.
Show both fingerprint conventions
The SHA256 fingerprint uses standard Base64 without trailing padding. The MD5 fingerprint uses lowercase hex pairs separated by colons. Both hash the same SSH wire blob, not the visible line or its comment.
Export a complete comparison record
The JSON report includes type, bit length, comment, decoded byte count, parameters and fingerprints for each supplied key. The sameKey field is null for one key and a boolean for two, so absence is distinct from a mismatch.
Accepted formats and inspection limits
- One ordinary OpenSSH public key per field
- RSA, Ed25519, legacy DSA and ECDSA nistp256/384/521 are supported. DSA requires 1024-bit p and 160-bit q; ECDSA accepts only an uncompressed point of the expected length. Each field allows at most 16,384 UTF-16 units.
- Containers and prefixes are outside this parser
- Private keys are refused. PEM, DER, JWK, RFC4716, certificates, FIDO sk-* keys, authorized_keys options, known_hosts prefixes and multiple key lines are unsupported. No file import or remote host lookup is offered.
- Strict decoding, no automatic repair
- Outer whitespace is allowed. Standard Base64 accepts correct padding or omitted padding, but rejects URL-safe symbols and noncanonical unused bits. Inner and outer algorithms must agree; truncated fields, negative or redundant mpints and trailing bytes are rejected.
- Structure is not a trust decision
- This tool does not check curve membership, RSA factorization or DSA group properties. It neither proves ownership nor tests login, signatures, server identity or authorization. MD5 and DSA are exposed only for inspecting legacy records.
- Refresh and undo are explicit
- Any input edit invalidates the report, even if only a comment changes. Clear and Example show replacement counts before applying. One undo restores inputs and output; another edit discards that snapshot. Input is never rewritten to fix malformed data.
SSH key inspector questions
How do I get the fingerprint of an existing public key?
Paste its single OpenSSH public line. The report displays both hashes. On your computer, ssh-keygen -lf key.pub produces the SHA256 fingerprint, while ssh-keygen -l -E md5 -f key.pub selects the legacy representation.
Why does my client show SHA256 when I only have an MD5 fingerprint?
They are different hashes of the key, not two encodings of one digest. Obtain the public key and recompute the required hash. Compare SHA256 with SHA256 or MD5 with MD5; you cannot convert one fingerprint back into the other.
Why is my private key rejected?
The public .pub line contains everything needed for inspection. This page refuses recognizable private-key containers before accepting pasted text. If you only have a private key, derive its public part on your own computer first.
Where is the comment in the result?
It appears as a separate field. A missing comment is valid and shown explicitly. Comments are neither hashed nor compared, so changing the email address at the end cannot turn a matching public key into a different one.
Does the SHA256 fingerprint match ssh-keygen?
Yes, for the supported ordinary OpenSSH public-key blobs. Hashing the file as text gives a different result. Cloud key-pair identifiers may use other serialized data or rules, so this report does not promise to match every cloud console.
Need another key format?
Compare a known pair
Start with SSH key inspector and its public example. Change a comment, then try a different public key to see which part actually controls the match.