SSH & Keys

SSH Key Validator

Key Validation

Validate an SSH Key

Check a key's format and security, or match a public and private key pair.

Key to validatepublic or private, any format

Keys are processed securely and deleted immediately after checking.

Learn more

Guides & explainers related to this tool

Article

SSH Keys Explained

Public vs private keys and how authentication works.

Article

PEM vs PPK

The two private-key formats and when to use each.

Tool features

Comprehensive SSH key validation and security analysis with detailed recommendations
4 features

Format validation

Confirms a key parses as a valid OpenSSH, PEM or PPK structure.

Strength analysis

Flags undersized RSA keys and other weak choices, with a plain-English verdict.

Pair matching

Checks whether a public and private key actually belong together.

Actionable recommendations

Tells you what to change, not just what is wrong.

What SSH key validation checks & how it works

Format, strength, and whether a pair actually matches

Validating an SSH key answers two different questions. The first is structural: does this file actually parse as a key, and is it the format the tool you are feeding it expects? A key that has been mangled by a copy-paste, saved with Windows line endings, or wrapped by an editor will fail in ways whose error messages rarely say so.

The second question is whether a public and private key belong together. Because the public key is mathematically derived from the private one, you can check a pair without ever using it to log in — derive the public half and compare fingerprints. Use Validate key for the first question and Match key pair for the second.

OpenSSH format
The modern default, starting -----BEGIN OPENSSH PRIVATE KEY-----. What ssh-keygen writes today.
PEM format
The older wrapper, e.g. -----BEGIN RSA PRIVATE KEY-----. Still required by some libraries and cloud consoles.
Key pair match
Confirms a private key produces the public key you have — the check that tells you which of the two is the odd one out.
Encrypted key
A private key protected by a passphrase. Validation needs that passphrase to read past the encryption header.

How to use this tool

Validate a key or match a pair in four steps
1
Pick validate or match
Use Validate key to check one key's format and strength. Use Match key pair when you have both halves and need to know whether they go together.
2
Paste or upload the key
Public or private, in OpenSSH, PEM or PPK form. In match mode you supply both — the private key and the public key you want to test it against.
3
Enter the passphrase if prompted
If the private key is encrypted, a passphrase field appears. Without it the key cannot be parsed past its encryption header, so validation will stop there.
4
Read the checks
Validation returns a pass/warn/fail row per check, the parsed structure, and recommendations. Match mode compares the fingerprint derived from the private key against the one from the public key.

Related tools

Keep debugging with tools from the same suite
3 tools
SSH Key Fingerprint
Calculate and analyze SSH key fingerprints with multiple algorithms (MD5, SHA256)
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail

Frequently asked questions

Common questions about validating and matching SSH keys
7 Q&A

Switch to Match key pair, supply both, and compare the result. The check derives the public key from the private one and compares fingerprints — the same thing ssh-keygen -y -f id_ed25519 does locally. If they differ, one of the two is from a different pair.

Formatting, almost always. The usual culprits are Windows CRLF line endings, a missing final newline, an editor that wrapped the base64 body onto multiple lines, or a copy that dropped the -----BEGIN----- / -----END----- markers. Re-copy the file with cat rather than opening it in a rich-text editor.

For RSA, 2048 bits is the practical floor and 4096 is the comfortable choice; anything at 1024 bits or below should be replaced now. Ed25519 has a single fixed size equivalent to roughly 3000-bit RSA, which is why it exposes no size option at all.

Only for encrypted private keys, and only to read past the encryption header. If you would rather not, validate the public key instead — it is never encrypted, and it still tells you the algorithm, the bit length and whether the format is sound.

The key is sent to our server to be parsed and is discarded immediately — it is not stored or logged. Even so, a private key is a credential, so treat this as suitable for test and lab keys. To check a production key without it leaving your machine, run ssh-keygen -y -f ~/.ssh/id_ed25519 and compare the output with your .pub file yourself.

They are two containers for the same key material. Files beginning -----BEGIN OPENSSH PRIVATE KEY----- use the modern format that ssh-keygen writes by default; -----BEGIN RSA PRIVATE KEY----- is the older PEM form that some libraries and cloud consoles still require. Convert with ssh-keygen -p -m PEM -f keyfile.

No. Validation inspects structure and strength — it cannot know whether a copy of your private key exists somewhere it should not. If you suspect exposure, treat the key as burned: generate a replacement, install the new public key, and remove the old one from every authorized_keys file and Git host it reached.