SSH and PGP key inspector

Keys turn up in many shapes: a line in authorized_keys with options in front, a hashed known_hosts file, an id_ed25519 you’re not sure has a passphrase, a PGP key someone emailed you. This tool reads all of them in the page and tells you what they are, what they’re for, and whether anything about them is weak, expired or revoked.

How to use it

Paste into the box, drop a file on it, or use Open file…. Several keys at once are fine; each gets its own card. Examples loads throwaway keys made for this page.

SSH public keys — ssh-rsa, ssh-dss, ecdsa-sha2-nistp256/384/521, ssh-ed25519, and the FIDO security-key types sk-ssh-ed25519@openssh.com and sk-ecdsa-sha2-nistp256@openssh.com (with their application string), as .pub lines or RFC 4716 ---- BEGIN SSH2 PUBLIC KEY ---- blocks. You get the size, the SHA256 and legacy MD5 fingerprints and the randomart picture — character for character what ssh-keygen -l, ssh-keygen -E md5 -l and ssh-keygen -lv print — and a note on strength (RSA under 2048 bits and DSA are flagged).
OpenSSH certificates (…-cert-v01@openssh.com, made with ssh-keygen -s) — user or host, key ID, serial, principals, validity, critical options (force-command, source-address), extensions, and the signing CA’s fingerprint, as ssh-keygen -L shows them.
authorized_keys lines — every option is split out (quoted values with commas and spaces are handled) and explained: from=, command=, restrict, no-pty, permitopen=, environment=, expiry-time=, cert-authority, principals= and the rest. Options sshd doesn’t know are marked.
known_hosts lines — host lists, [host]:port, wildcards, @cert-authority and @revoked. Hashed entries (|1|salt|hash, from HashKnownHosts yes or ssh-keygen -H) can’t be read back, but Check a host computes the HMAC for a name and port you type and highlights the entries that belong to it.
OpenSSH private keys (BEGIN OPENSSH PRIVATE KEY) — cipher, KDF (bcrypt rounds and salt), how many keys, and the public half with its fingerprint, which is readable even when the key is encrypted. If it has no passphrase, the comment and the check integers are shown too. The secret numbers themselves are never displayed — only their sizes.
PEM and DER keys — PKCS#1 (BEGIN RSA PRIVATE KEY/RSA PUBLIC KEY), PKCS#8 (including ENCRYPTED PRIVATE KEY, with its PBES2/PBKDF2 or scrypt parameters), SubjectPublicKeyInfo (BEGIN PUBLIC KEY) and SEC1 EC keys: algorithm, size or curve, the matching OpenSSH public line and fingerprint, and an ASN.1 tree with secret values hidden. For X.509 certificates and CSRs use the certificate decoder.
OpenPGP — armoured (the CRC-24 checksum is checked) or binary .gpg files. A gpg --list-keys style summary comes first, then each key and subkey with version (v4, the LibrePGP v5 that GnuPG 2.5 makes, and RFC 9580 v6), algorithm and curve, creation and expiry dates (from the self-signatures), usage flags, key ID and fingerprint, and the user IDs. Warnings cover short RSA, DSA, expired or revoked keys, SHA-1 self-signatures, keys that never expire, and unprotected secret keys. Packets lists every packet; signatures show their type, hash and every hashed and unhashed subpacket. Secret-key packets show only how they are protected (S2K type, cipher, hash, iteration count) — nothing is decrypted.

Generate makes a new key pair with the browser’s Web Crypto — Ed25519, ECDSA P-256 or P-384, or RSA 2048–4096 — and gives you the OpenSSH public line, the private key in OpenSSH format (no passphrase; ssh-keygen -p adds one) and as PKCS#8 PEM, with download buttons. Files made here load in OpenSSH (ssh-keygen -y -f and ssh-keygen -Y sign accept them). Even so, a key generated in a web page is only as trustworthy as the page and browser; for keys that matter, run ssh-keygen -t ed25519 on the machine that uses it, or put it on a security key with -t ed25519-sk.

Related: hashes and HMACs, Base64, JWT decoder, certificate decoder, and data recipe for chaining decodes.

Browser support

Inspecting works in any current browser. Generating Ed25519 keys needs Web Crypto Ed25519, which arrived in Firefox 129, Safari 17 and Chrome/Edge 137; older browsers can still generate ECDSA and RSA keys. Deriving the public half of an Ed25519 or EC PKCS#8 private key that doesn’t store it uses Web Crypto too.

Privacy

Everything is parsed and generated in this page; nothing is sent anywhere and nothing you paste is stored. Share link carries only public material: OpenSSH, PEM and PGP private key blocks are stripped from the shared text, and a dropped binary file is never shared. Only the generator’s key type and comment are remembered in your browser. The example keys are throwaway keys made for this page — don’t use them for anything.