Keys, Certificates & Tokens
SSH Host Key Parser
Decode an OpenSSH public key line or blob. See the key type and its RSA, ECDSA, or Ed25519 public values, decoded in your browser.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
The parser decodes supported OpenSSH public-key blobs and checks their length fields.
The output contains the algorithm and public key values. It does not contain a SHA256 fingerprint.
- Confirm the algorithm of a host key before you add it to known_hosts.
Sources: RFC 4253: SSH public key formats; RFC 5656: SSH elliptic curve public keys
Read an Ed25519 host-key record
Input: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8g
Settings: Input Format Auto. The 32 key bytes are synthetic values 0x01 through 0x20.
Result: Key type: ssh-ed25519 x: 0x0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20
A blob with only 31 key bytes fails. Ed25519 public keys need exactly 32 bytes.
Check key fields without assuming host identity
- Paste a public key line, or select Base64 or Hex for a bare blob.
- Remove the host name from known_hosts or ssh-keyscan output first.
- Compare the parsed type and values with your server inventory.
- Private keys, OpenSSH certificates, and sk- security-key types are unsupported.
- ECDSA point checks cover length, not curve membership.
- Valid structure does not establish ownership. Confirm the key through a trusted channel.