Skip to content
Marvin's Toolbox.

SSH and PGP Key Inspector

Paste an SSH or PGP public key, or a whole authorized_keys or known_hosts file, to see each key's algorithm, size, fingerprints, comment, certificate details, user IDs, subkeys and expiry dates.

Runs entirely in your browser. Nothing you put in here gets uploaded.

Key file · drop a .pub, .asc, .gpg, .ppk, authorized_keys or known_hosts file

No key yet

Paste an SSH public key, an authorized_keys or known_hosts file, or a PGP key block above to see its fingerprints, size, comment, user IDs and expiry.

About the SSH and PGP Key Inspector Tool

This tool reads SSH and PGP keys and shows what is inside: the algorithm and key size, the SHA256 and MD5 fingerprints exactly as ssh-keygen -lf prints them, the comment, and for PGP keys the fingerprint, key ID, user IDs, subkeys and expiry dates.

Paste a single public key line or a whole authorized_keys or known_hosts file and every key gets its own card with its line number. Options in front of a key, hashed host names and @cert-authority or @revoked markers are read too. Weak, expired and revoked keys are flagged so they stand out in a long file.

What you can do

  • Get the SHA256 fingerprint of an SSH public key like ssh-keygen -lf
  • Get the old MD5 fingerprint of an SSH key
  • List every key in an authorized_keys file with its comment and options
  • Check which known_hosts entry matches a host, hashed entries included
  • Decode an SSH certificate and see its principals, validity and CA
  • View a PGP public key's fingerprint, key ID and user IDs
  • Check when a PGP key or one of its subkeys expires
  • Find out whether a PGP key has been revoked
  • Spot weak keys such as RSA under 2048 bits or DSA

How to use the SSH and PGP Key Inspector

  1. 1Paste a key, a whole file, or drop a key file on the field. The examples menu loads an authorized_keys file, a known_hosts file or a PGP key.
  2. 2Read each key's card for its type, size, fingerprints and any warnings.
  3. 3Copy a fingerprint with its copy button, or copy all of them at once in ssh-keygen format.
  4. 4For known_hosts files, type a host name to see which entries match it.

Supported SSH formats

Public keys of type ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, nistp384 and nistp521, the FIDO security keys sk-ssh-ed25519 and sk-ecdsa-sha2-nistp256, and the legacy ssh-dss. Every one of them also works as an OpenSSH certificate (-cert-v01@openssh.com), which shows the key ID, serial, principals, validity window, critical options, extensions and the signing CA's fingerprint.

Besides the usual one-line form, the tool reads RFC 4716 public keys, PEM public keys and the public half of OpenSSH, PEM and PuTTY private keys. The randomart picture that ssh-keygen -lv draws can be switched on for every key.

PGP keys

Armored public keys, several in one block, and binary .gpg keyrings are read with OpenPGP.js. Each key shows its version (v4 or v6), algorithm and size or curve, creation and expiry dates, usage flags, and whether it was revoked and why. Every user ID shows whether its self-signature checks out, and subkeys list their usage (sign, encrypt, authenticate) and expiry.

If you paste a private key

The tool notices private keys and only ever shows their public half, along with a clear warning. A button swaps the pasted private key for its public counterpart, so you can keep working without the secret on screen. Passphrase protected PEM keys can't be opened, but encrypted OpenSSH and PuTTY keys still show their fingerprint because they store the public key in the clear.

Credits

Open source does the heavy lifting in this tool. Thank you to:

  • OpenPGP.js

    A JavaScript implementation of the OpenPGP standard, maintained by Proton.

Everything this site builds on is listed on the credits page.

Related tools

Tools that share a tag with this one.

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a checksum online: drop a file, paste the expected checksum and see instantly whether they match. The hash type is detected from the checksum itself, covering MD5, SHA-1, SHA-256, SHA-512, BLAKE3, CRC-32 and more, and sha256sum lines or whole checksum files can be pasted as-is.

devsecurity

CSP Builder

Build a Content-Security-Policy header directive by directive, or paste an existing policy to check it. Weak spots like unsafe-inline, wildcards and missing directives are flagged with what to do instead.

securitydev

CSR Generator

Create a certificate signing request with a fresh RSA or ECDSA key or your own. Fill in the subject and subject alternative names, then download the CSR and private key as PEM, with the matching openssl command alongside.

securitydev

Email Header Analyzer

Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.

devsecurity

Hash Generator

Hash text or a file with MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32 and more, all computed live as you type. Compare against an expected checksum and copy any digest.

devsecurity