Convert an SSH public key between OpenSSH one-line and RFC 4716 SSH2 format
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.PuTTYgen and some commercial SSH servers save public keys in the RFC 4716 format that starts with ---- BEGIN SSH2 PUBLIC KEY ----, while OpenSSH and authorized_keys want one line such as ssh-ed25519 AAAA... Paste either form and copy the other, with the comment carried across. The fingerprint is shown for both, so you can confirm the key did not change.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
A fingerprint is how people compare SSH keys without reading hundreds of Base64 characters. GitHub's SSH keys page, the "authenticity of host can't be established" prompt and server logs all show one. This page computes it from the key you paste, so you can match a key in authorized_keys to a person, or check a host key before trusting it.
What it reads. One key per line from id_ed25519.pub or id_rsa.pub, whole authorized_keys files including options such as from="10.0.0.0/8" or command="...", known_hosts lines with their host names, and RFC 4716 blocks starting ---- BEGIN SSH2 PUBLIC KEY ----, as PuTTYgen saves them. RSA, DSA, ECDSA (P-256, P-384, P-521), Ed25519 and the security-key types ECDSA-SK and Ed25519-SK are understood.
How it was checked. Twenty-eight throwaway keys of every common type were made with ssh-keygen, and for each one the summary line, both fingerprints, both randomart pictures and the RFC 4716 form here are identical to what ssh-keygen printed. Nothing you paste leaves your browser.
The rest of the article, and all 6 questions about SSH Key Fingerprint, are on the SSH Key Fingerprint page.
On the command line, ssh-keygen -lf ~/.ssh/id_ed25519.pub prints it. Here, paste the contents of the .pub file and the same line appears: the size, the SHA256 fingerprint, the comment and the type. Use the public key only; the private key is never needed for a fingerprint.
Both identify the same key. SHA256 fingerprints, written as SHA256: and 43 Base64 characters, have been the OpenSSH default since version 6.8 in 2015. MD5 fingerprints, written as 16 hex pairs separated by colons, are older but still shown by some cloud consoles and older servers.
Paste the whole authorized_keys file. Every key is listed with its line number, options, comment and fingerprint. Ask each person for the fingerprint of their own key, or compare with the fingerprints GitHub or GitLab show on their SSH keys pages, and remove the lines nobody claims.
Paste the key that starts with ---- BEGIN SSH2 PUBLIC KEY ---- and copy the OpenSSH line shown for it, which starts with ssh-rsa or ssh-ed25519 and can go straight into authorized_keys. The fingerprint stays the same, which proves only the format changed and not the key.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about SSH Key Fingerprint and anybody who knows can answer. No account needed.
Same job, other tools: 2FA Code Generator – Get the current two-factor code from a setup key, without a phone.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember.