Contact

Tools  /  Security  /  SSH Key Format Checker

SECURITY

SSH Key Format Checker

Audit a whole authorized_keys or known_hosts file -- per-line validation, option/marker parsing, duplicate detection, weak-key and unrestricted-access warnings.

More Security tools

Password Entropy Calculator Hash Generator Password Generator JWT Decoder & Generator HMAC Generator Hash Identifier

What this tool does

Audits an entire authorized_keys or known_hosts file line by line -- not just a single key. For a single key's deep decode (fingerprints, randomart, PEM conversion), use this site's Public Key Format Checker; this tool is for the multi-line files those keys actually live in, and the mistakes that only show up across a whole file.

authorized_keys: options and what they mean

Each line can carry options before the key type that restrict what that key is allowed to do once authenticated -- command= (force a single command), from= (restrict source IPs/hosts), no-pty, no-port-forwarding, no-agent-forwarding, no-X11-forwarding, no-user-rc, permitopen=, restrict (deny everything not explicitly re-enabled), principals=, and cert-authority. A key with none of these has full, unrestricted access -- flagged here as worth a second look, not necessarily wrong.

known_hosts: hashed hosts and markers

A known_hosts line can list one or more hostname/IP patterns in plain text, or a single hashed hostname (|1|salt|hmac, so a stolen file doesn't reveal which hosts you connect to) -- both are recognized and labeled. The @cert-authority and @revoked line markers are also parsed and shown.

Duplicate and weak-key detection

Identical key blobs appearing on more than one line are flagged as duplicates -- harmless but usually accidental. ssh-dss (DSA) keys are flagged deprecated; RSA keys under 2048 bits are flagged weak -- the same strength bar used across this site's other key tools.

Per-line validation

Every line is decoded independently -- a single malformed or truncated line is reported for that line specifically rather than failing the whole file, since a 200-line authorized_keys file with one bad entry is a very different problem than a completely broken paste.

Cleaned export

Download just the lines that actually decoded successfully -- useful for dropping a cleaned, de-duplicated file back onto a server after an audit.

Why this is separate from the Public Key Format Checker

That tool goes deep on one key -- fingerprints, randomart, format conversion. This one goes wide across a whole file -- the view an administrator actually has when reviewing who has access to a server, or whether a known_hosts file is clean.

Privacy

Every line is parsed entirely in your browser. Nothing is uploaded.

FAQ

Frequently asked questions

What's the difference between this and the Public Key Format Checker?
The Public Key Format Checker decodes one key deeply -- fingerprints, randomart, PEM conversion. This tool audits a whole authorized_keys or known_hosts file at once -- every line, its options or host markers, duplicates, and weak keys across the file.
What do the authorized_keys options actually restrict?
command= forces every login with that key to run a single fixed command; from= restricts which source hosts/IPs can use it; no-pty, no-port-forwarding, no-agent-forwarding, no-X11-forwarding and no-user-rc each disable one specific capability; restrict disables everything not explicitly re-enabled afterward. A key with none of these has full, unrestricted access.
Why does a hashed known_hosts hostname look different?
HashKnownHosts replaces the plaintext hostname with |1|salt|hmac so that if the known_hosts file leaks, it doesn't reveal which hosts you connect to. This tool recognizes and labels that format rather than treating it as invalid.
Why flag a key as having "unrestricted access"?
It's informational, not an error -- many legitimate keys intentionally have full access. It's flagged so you notice it during a deliberate audit, since an authorized_keys file accumulated over years often has more full-access entries than anyone intended.
What counts as a "weak" key here?
ssh-dss (DSA) keys are flagged deprecated outright, and RSA keys under 2048 bits are flagged weak -- the same strength thresholds used across this site's other key tools.
Does one bad line break the whole audit?
No -- each line is decoded independently, so one malformed or truncated entry is reported for that specific line while every other valid line is still fully parsed and shown.
Can I export a cleaned version of my file?
Yes -- the download button exports only the lines that decoded successfully, useful for replacing a file on a server after reviewing what an audit found.
Is my file uploaded anywhere?
No. Every line is parsed entirely in your browser -- this tool has no server component.
Theme Accent