SSH key fingerprint

Decode an OpenSSH public key line and show its type, size, and SHA256/MD5 fingerprints in ssh-keygen -l format.

SSH key fingerprint decodes one OpenSSH public key line, ssh-ed25519, ssh-rsa, ssh-dss or any ecdsa-sha2-* curve, into its type, bit size and comment. It prints both the SHA256 and the legacy MD5 fingerprint, in the exact format ssh-keygen -l shows. A declared key type that does not match the type inside the blob is refused, and so is any unsupported key type.

Questions

What key types are supported?

ssh-ed25519, ssh-rsa, ssh-dss and any ecdsa-sha2-* curve.

What fingerprints does it print?

Both SHA256 and the legacy MD5, plus the exact one-line format ssh-keygen -l shows.

What happens if the declared type does not match the key blob?

The tool refuses, naming both the declared type and the type encoded inside the blob.

What if the key type is not one of the four supported families?

The tool refuses, naming the unsupported type.

Does it show the key comment?

Yes, the third field on the line, or '(none)' if there is not one.

Related Security tools

n→nX.509 certificate parserDecode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions, parsing every certificate in a multi-cert PEM chain instead of only the first. Reports what each certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.n→nCSR parserDecode a PEM or DER PKCS#10 certificate signing request into subject, public key and requested extensions (including subjectAltName, when present in an extensionRequest attribute). Reports the request, not a decision about whether it should be signed.n→nCRL parserDecode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.n→nJWK ↔ PEMConvert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.n→nPEM ↔ HexConvert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.n→nPublic key from cert / private keyExtract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.n→nCertificate chain validatorCheck that each certificate in a PEM chain was signed by the next one, with a valid signature, a current validity window, and CA flags that line up.n→nPEM bundle splitSplit a PEM bundle, such as a certificate chain, into one file per block.