{
  "slug": "ssh-public-key-parser",
  "name": "gizza-ai/ssh-public-key-parser",
  "version": "0.1.0",
  "title": "SSH Public Key Parser — Fingerprint, Type and Bit Size — gizza.ai",
  "description": "Paste an OpenSSH public key, authorized_keys or known_hosts line and read its algorithm, bit size, comment and SHA256/MD5 fingerprints — free, in your browser.",
  "tags": [
    "ssh public key parser",
    "ssh key fingerprint",
    "ssh-keygen -l online",
    "authorized_keys parser",
    "known_hosts parser",
    "ssh key type",
    "ed25519 fingerprint",
    "rsa key size",
    "ssh certificate decoder"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/ssh-public-key-parser/",
    "markdown": "https://gizza.ai/tools/ssh-public-key-parser/index.md",
    "descriptor": "https://gizza.ai/tools/ssh-public-key-parser/tool.json",
    "deep_link_example": "https://gizza.ai/tools/ssh-public-key-parser/?input=ssh-ed25519%20AAAAC3NzaC1lZDI1NTE5AAAAIPc21YeL9wdmn0Bvy1dVCZH%2FrO%2FhcbVFBt5YQ%2FY8%2BoOy%20alice%40example.com&expected_fingerprint=SHA256%3A%2FPcooB4wsFrX%2FEAwN1wlE0KJbNvM1usU1KT6lCXUah4&include_sha1=true&uppercase_md5=true"
  },
  "cli": "gizza tool ssh-public-key-parser \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPc21YeL9wdmn0Bvy1dVCZH/rO/hcbVFBt5YQ/Y8+oOy alice@example.com\"",
  "tool": {
    "description": "Parse OpenSSH PUBLIC keys entirely offline and report what is inside them. Paste one or more keys as 'input': a plain id_*.pub line, an authorized_keys line with an options prefix, a known_hosts entry (host patterns or |1| hashed, with @cert-authority/@revoked markers), an OpenSSH certificate (*-cert-v01@openssh.com), or an RFC 4716 '---- BEGIN SSH2 PUBLIC KEY ----' block. For each key it returns the source format, the algorithm, the key family and size in bits (RSA modulus bits, ECDSA curve, Ed25519), the curve name, the comment, the SHA256 and MD5 fingerprints exactly as 'ssh-keygen -l' prints them (SHA-1 optional via 'include_sha1'), the authorized_keys options or known_hosts host patterns, FIDO application for sk-* keys, and a strength rating with warnings (short RSA, obsolete DSA, declared-vs-embedded algorithm mismatch). Certificates additionally report user/host type, serial, key ID, principals, validity window and status, critical options, extensions and the signing CA's fingerprint. Set 'expected_fingerprint' to verify keys against a known fingerprint in any printed form. Multiple keys are summarised with a key count and a unique-fingerprint count. Private keys are never parsed. Returns one JSON report.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "expected_fingerprint": {
          "description": "Optional fingerprint to verify each key against, e.g. when checking a host key against one published out of band. Accepts any printed form: 'SHA256:<base64>', the bare base64, 'MD5:aa:bb:…', bare colon-hex, or plain hex; prefixes, colons, spaces and hex case are ignored. Adds 'fingerprint_match' to every key and 'expected_fingerprint_matched' to the report. Default: no comparison.",
          "type": "string"
        },
        "include_sha1": {
          "default": false,
          "description": "Also report the legacy SHA-1 fingerprint (the same value 'ssh-keygen -l -E sha1' prints, base64 with a SHA1: prefix). Only needed for old tooling — SHA-256 is the modern default. Default: false.",
          "type": "boolean"
        },
        "input": {
          "description": "The SSH PUBLIC key(s) to parse, pasted verbatim. Accepts a plain OpenSSH line ('ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA… user@host'), an authorized_keys line with an options prefix ('command=\"…\",no-pty ssh-rsa AAAA… user@host'), a known_hosts entry (host patterns or a |1| hashed host, optionally prefixed with @cert-authority or @revoked), an OpenSSH certificate (*-cert-v01@openssh.com), or an RFC 4716 '---- BEGIN SSH2 PUBLIC KEY ----' block. Multiple keys may be pasted at once — one per line, blank lines and # comments are ignored — up to 200 keys and 256 KiB. Supported algorithms: ssh-ed25519, ssh-rsa, ssh-dss, ecdsa-sha2-nistp256/384/521 and the sk-* FIDO variants. PRIVATE keys and PEM public keys are rejected with guidance instead of being parsed.",
          "type": "string"
        },
        "now": {
          "description": "Reference time as seconds since the Unix epoch, used to report each OpenSSH CERTIFICATE's validity status and days-until-expiry. When omitted (0), the current clock time is used. Has no effect on plain (non-certificate) keys.",
          "minimum": 0,
          "type": "integer"
        },
        "uppercase_md5": {
          "default": false,
          "description": "Print the MD5 fingerprint's hex digits in UPPERCASE (AA:BB:…) to match older consoles and inventory systems that display them that way. The digest is identical either way. Default: false (lowercase, as ssh-keygen prints it).",
          "type": "boolean"
        }
      },
      "required": [
        "input"
      ],
      "type": "object"
    }
  }
}