Check an SSH Key's Fingerprint, Type and Size KEYPRINT

The keys

Public keys only. A private key pasted here by mistake is recognised and not read.

What a fingerprint is, and why check one

An SSH key is a long run of base64 nobody compares by eye. Its fingerprint is a hash of the key, short enough to read out over the phone: what ssh-keygen -l prints, what GitHub and GitLab show beside every key on an account, and what SSH asks you to confirm the first time you connect to a server. Checking that two fingerprints match is how you know the key on the server is the one on the laptop, or that the host you are connecting to is the host its owner says.

KEYPRINT computes the fingerprint from the key itself, in both forms still in use: SHA256, the base64 one current OpenSSH prints, and MD5, the colon-separated hex that older systems and some control panels still show. It reads the key's wire format to give its real type and size, rather than trusting the label in front of it.

Auditing an authorized_keys file

An authorized_keys file is the list of every key that can log in as that account, and on long-lived servers it collects keys nobody can put a name to. Paste the whole file. Each line is read with its options (from=, command=, no-pty, restrict), and the page flags what should go:

• DSA keys, which OpenSSH stopped accepting by default in 2015.
• RSA keys under 2048 bits.
• The same key twice, often under two different comments, which usually means a key meant to be removed was relabelled instead.
• Keys the text says are one type and the data says are another.

Certificates, known_hosts and the rest

OpenSSH certificates are read in full: user or host, key ID, serial, principals, the validity window, critical options, extensions, and the fingerprint of the CA that signed them. A certificate with no principals is flagged, because OpenSSH treats it as valid for any user, and so is one that never expires or was signed with SHA-1. known_hosts lines are read with their host lists, including hashed entries and @cert-authority and @revoked markers, and keys exported in the RFC 4716 format that PuTTY and some commercial SSH products write are read too.

Everything is computed in this tab; nothing is sent. For a TLS certificate rather than an SSH key, CERTLENS takes it apart. To make a new key pair in the browser, KEYRING makes an age key, and SENTINEL finds private keys left in files before they are shared.