Paste a public-key line to inspect its fields and fingerprint. A matching fingerprint identifies key bytes, not the owner or their authorization.
Runs locally in your browserA matching fingerprint confirms key bytes, not ownership or authorization. Review authorized_keys options, file permissions, account scope, host trust, and rotation policy separately.
This page reads one line of OpenSSH public-key text in the browser and reports what is inside it: the algorithm, the key size, the curve or exponent, the comment, any authorized_keys options, and the SHA-256 fingerprint in the format ssh-keygen prints. The key never leaves the tab.
Paste a line from ~/.ssh/id_ed25519.pub or from an authorized_keys file and press Inspect public key. The panel shows the parsed fields, the findings and a normalized copy of the line; Copy fingerprint and Copy key put those results on the clipboard.
Only the first non-empty, non-comment line is inspected. After the optional authorized_keys options come the type (ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, sk-ssh-ed25519@openssh.com and similar) and the Base64 blob. The blob repeats the type inside itself, and a line whose inner and outer types disagree is rejected instead of being reported.
The bit count is measured from the key material, not from the type name: Ed25519 reports 256 bits, an RSA line reports the real modulus size, and an ECDSA line reports the curve name next to its size. The blob byte count is shown as decoded, so it can be compared with the line that was pasted.
The fingerprint is the SHA-256 digest of the decoded blob, Base64-encoded without padding and prefixed with SHA256: - the same value that ssh-keygen -l -E sha256 -f id_ed25519.pub prints. The bytes that are fingerprinted and the line that is copied always describe the key that was pasted, because editing the input empties the panel and the cached values first.
Copy key returns the line as parsed: type, blob and comment, without the options prefix. Keep the original file as the source of truth when a key is deployed, and use the copy for chat messages or ticket comments where one wrong character would be invisible.
DSA / ssh-dss is reported as obsolete, an RSA modulus below 2048 bits as too weak, and a missing comment as harder to inventory. Anything the parser sees but OpenSSH would ignore or reject - bytes after the last field, for example - is raised as a warning instead of being dropped silently.
Everything happens locally: no key is sent to a server, no SSH connection is opened and no host is asked whether it knows the key. A matching fingerprint proves that the bytes are identical; access also depends on authorized_keys options, file permissions, the account and the server policy.