Key Type
SSH Key Reference
Key Types
- Ed25519: Modern, fast, 256-bit
- RSA 2048: Minimum recommended
- RSA 4096: Higher security margin
- DSA: Deprecated, avoid
- ECDSA: Curve concerns exist
Best Practices
- Prefer Ed25519 for new keys
- Use passphrases for private keys
- Rotate keys periodically
- Keep private keys secure (0600)
- Use SSH agent forwarding cautiously
How to check an SSH public key
- Open the Analyze tab.
- Paste one public key line, for example the contents of
~/.ssh/id_ed25519.pubor one line fromauthorized_keys:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... alice@laptop. Only the first key is read. - Press Analyze Key. Everything is computed in your browser.
- Compare the fingerprint with the one the server, GitHub or your colleague shows you.
Reading the results
Key type is read from the decoded key blob, not just the text label: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521, the FIDO sk-* variants, or the obsolete ssh-dss. If the label and the blob disagree, the tool trusts the blob (as ssh-keygen does) and flags the mismatch. Bit length is the modulus bit length for RSA (the leading sign byte is stripped first); Ed25519 is always 256 and ECDSA follows its curve.
Security follows NIST SP 800-57: Ed25519 and RSA 3072+ are Strong, RSA 2048 to 3071 and ECDSA P-256 are Acceptable (ECDSA P-384/521 Strong), RSA 1024 to 2047 is Weak, smaller RSA is Insecure, and DSA is Deprecated. OpenSSH has disabled DSA by default since release 7.0, so a DSA key will usually not work anyway.
Fingerprints are shown in both forms. SHA256 is the base64 of the SHA-256 of the key blob (no padding) — the value ssh-keygen -lf prints and the one servers show on first connection. MD5 is the colon-separated hex of the MD5 of the same blob, printed by older OpenSSH and ssh-keygen -E md5 -lf. Both are computed from the raw key bytes, so they match ssh-keygen exactly. Comment is the free text after the key, often user@host; it can be edited freely and proves nothing about who owns the key.
References
- RFC 4253 §6.6 — SSH public-key wire format (ssh-rsa, ssh-dss)
- RFC 5656 — ECDSA for SSH (nistp256/384/521)
- RFC 8709 — Ed25519 / Ed448 for SSH
- ssh-keygen(1) — the reference implementation this tool matches
- NIST SP 800-57 Pt.1 Rev.5 — key-strength thresholds
Frequently asked questions
How do I get the fingerprint of an SSH public key?
Paste the key in the Analyze tab. On the command line, run ssh-keygen -lf ~/.ssh/id_ed25519.pub. Both give the SHA256 form, for example SHA256:m4TZ9LhFg1dH2k8vQpXcR7nJwYs3uE0aBbCdEfGhIjK.
Why does my server show a different fingerprint format?
Older OpenSSH versions and some tools print an MD5 fingerprint in colon-separated hex, such as 3f:9a:1c:07:.... It is the same key hashed differently. This page shows both the modern SHA256 form and the legacy MD5 form, so you can match whichever your server prints. On the command line, ssh-keygen -E md5 -lf key.pub gives the MD5 form.
Is RSA 2048 still OK for SSH?
Yes, 2048-bit RSA is still considered acceptable, and this tool rates it that way. For new keys prefer Ed25519: shorter, faster and supported by every current OpenSSH release. Replace any RSA key under 2048 bits and any DSA key.
Is it safe to paste my SSH public key here?
Yes. A public key is designed to be shared, and the analysis runs in your browser. Never paste the private key (the file without .pub) into any website.
Should I generate my SSH key in a browser?
The generator uses the browser’s Web Crypto API and nothing is sent to a server, but the private key is exported as a PKCS#8 PEM without a passphrase. For keys that protect real servers, ssh-keygen -t ed25519 on your own machine is the better choice. For OpenPGP keys, see the PGP key inspector.