Contact

Tools  /  Security  /  Public Key Format Checker

SECURITY

Public Key Format Checker

Identify and decode any public key format (OpenSSH, SSH2/RFC4716, PEM PKCS#1/PKCS#8, JWK, XML, PGP), with SHA256/MD5 fingerprints, ASCII randomart, and bidirectional OpenSSH to/from PEM conversion.

More Security tools

HTTP Security Header Reference Password Entropy Calculator Hash Generator Password Generator JWT Decoder & Generator HMAC Generator

What this tool does

Identifies which of nine real public key formats a pasted value is, decodes its actual algorithm/size/curve, and for SSH-wire-based keys computes the same SHA256 and MD5 fingerprints and ASCII-art randomart that ssh-keygen -lv produces -- plus converts a key between OpenSSH and PEM format directly in the browser.

Formats recognized

OpenSSH single-line (ssh-rsa, ssh-ed25519, ssh-dss, ecdsa-sha2-*), SSH2/RFC4716 multi-line blocks, PEM PKCS#8 (-----BEGIN PUBLIC KEY-----) and PKCS#1 RSA-specific PEM, an X.509 certificate (flagged, with a link to this site's Certificate / DER Structure Viewer for the full field decode), a private key (flagged as such rather than mis-described), JWK JSON, XML RSAKeyValue, a PuTTY .ppk file (detected, not decoded -- that's a private key container format), and a PGP ASCII-armored block (detected only; full OpenPGP packet decoding is out of scope here).

SHA256 and MD5 fingerprints

For any SSH-wire-format key, both fingerprints are computed the same way ssh-keygen -lf does: SHA256 is base64 of the SHA-256 digest of the raw key blob (no padding, prefixed SHA256:) — the modern default since OpenSSH 6.8. MD5 is the older colon-separated hex format, kept for compatibility with tooling that still expects it.

ASCII-art randomart

The same "drunken bishop" visualization ssh-keygen -lv draws — a walk across a 17×9 grid driven two bits at a time by the fingerprint's bytes, useful as a quick visual way to notice if two keys are different without reading a full hex string character by character.

Key strength

RSA keys under 2048 bits are flagged as weak/deprecated; 2048–3071 bits is acceptable; 3072+ is strong. EC keys (P-256 and up) and Ed25519 are flagged strong by default, reflecting current best-practice guidance.

Converting between OpenSSH and PEM

An OpenSSH-format RSA, Ed25519, or EC (P-256/P-384/P-521) key converts directly to a PEM PKCS#8 SubjectPublicKeyInfo block, and the reverse — equivalent to what ssh-keygen -e -m PEM / ssh-keygen -i -m PKCS8 do locally, done here entirely client-side.

What this tool doesn't do

It never asks for or accepts a private key for conversion — only public key material. PGP and PuTTY .ppk are recognized but not decoded further; both have their own distinct container formats that are a different project in scope.

Privacy

Everything — detection, decoding, fingerprinting, randomart, and conversion — runs entirely in your browser. Nothing is uploaded.

FAQ

Frequently asked questions

What key formats does this recognize?
OpenSSH single-line keys, SSH2/RFC4716 blocks, PEM PKCS#8 and PKCS#1 public keys, X.509 certificates, PEM private keys (flagged, not decoded as public), JWK JSON, XML RSAKeyValue, PuTTY .ppk files (detected only), and PGP ASCII-armored blocks (detected only).
How are the SHA256 and MD5 fingerprints computed?
The same way ssh-keygen -lf does: SHA256 is the base64 (no padding) of the SHA-256 digest of the raw key blob, prefixed SHA256: -- the current default. MD5 is the older colon-separated hex digest, kept for compatibility with tools that still expect it.
What is the ASCII-art randomart image?
The same "drunken bishop" visualization ssh-keygen -lv produces -- a deterministic walk across a 17x9 grid driven by the key's fingerprint bytes. It's a quick visual fingerprint comparison, not a security mechanism on its own.
Can I convert an OpenSSH key to PEM, or the other way?
Yes -- RSA, Ed25519, and EC (P-256/P-384/P-521) public keys convert in both directions directly in your browser, equivalent to ssh-keygen -e -m PEM and ssh-keygen -i -m PKCS8 run locally.
Why does it flag some RSA keys as weak?
RSA keys under 2048 bits are considered too weak for current use by essentially every modern guidance (NIST, major browsers, SSH clients) -- the strength pill reflects that directly rather than just showing a bare bit count.
Does this decode PGP keys or PuTTY .ppk files?
It detects both formats and says so, but doesn't decode further -- OpenPGP packet parsing and the PuTTY private-key container format are both substantial formats of their own, out of scope for a public-key format checker.
Can I check a private key here?
Pasting a private key is detected and flagged as such rather than mis-described as public, but this tool only decodes and converts public key material -- it never processes private key content beyond that flag.
Is anything I paste sent anywhere?
No. Detection, decoding, fingerprinting, randomart and conversion all happen entirely in your browser -- this tool has no server component.
Theme Accent