SSH & Keys

SSH Public Key Extractor

Public Key

Extract SSH Public Key

Paste or upload your PEM or PPK private key to extract the corresponding public key.

Key Format

Tool features

Comprehensive SSH public key extraction with support for multiple key formats
4 features

PEM & PPK support

Derives the public key from OpenSSH/PEM or PuTTY PPK private keys.

Discarded after use

The key is processed server-side and deleted immediately — not stored, not logged.

Paste or upload

Accepts pasted key text or an uploaded key file, with format validation up front.

Ready to install

Copy or download the .pub line for authorized_keys or a Git host.

How a public key is derived & why it can be recovered

The public half comes from the private key, not the other way round

A private key already contains everything needed to produce its public half — the public key is derived from it, not stored alongside it. That is why a lost .pub file is a minor inconvenience rather than a disaster: as long as you still have the private key, the public key can be regenerated exactly, and it will match every server that already trusts it.

This tool does the same job as ssh-keygen -y, accepting either an OpenSSH/PEM private key or a PuTTY .ppk. The result is a single authorized_keys-style line you can paste onto a server or into a Git host. Nothing about the private key changes, and no existing access is affected.

Public key
The derived half, one line beginning ssh-ed25519, ssh-rsa or ecdsa-sha2-….
ssh-keygen -y
The local equivalent: ssh-keygen -y -f id_ed25519 > id_ed25519.pub.
authorized_keys
The file on the server listing every public key allowed to log in as that account — one key per line.
Comment
The trailing user@host label. Cosmetic, and not always preserved when a key is re-derived.

How to use this tool

Recover a public key from its private key in four steps
1
Choose the key format
Select whether you are supplying a PEM/OpenSSH private key or a PuTTY .ppk, so the right extraction path is used.
2
Paste or upload the private key
Paste the full key including its -----BEGIN----- and -----END----- lines, or upload the file. A partial paste is the most common cause of failure.
3
Extract
Run the extraction. If the key is passphrase-protected, supply the passphrase so the key can be read.
4
Install the public key
Copy the resulting line into the server's ~/.ssh/authorized_keys, or paste it into your Git host's SSH key settings. Save it as id_ed25519.pub locally so you have it next time.

Related tools

Keep debugging with tools from the same suite
3 tools
SSH Key Validator
Validate SSH key format, structure, security, and verify public/private key matching
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication
SSH Key Converter
Convert SSH keys between different formats (OpenSSH, PuTTY PPK, PEM)

Frequently asked questions

Common questions about extracting SSH public keys
7 Q&A

Yes — that direction is straightforward and is exactly what ssh-keygen -y does. The public key is mathematically derived from the private one. The reverse is not possible: a public key tells you nothing useful about the private key, which is the entire basis of the scheme.

No. Re-derive the public key from the private key you still have and it will be byte-for-byte the key your servers already trust. Generating a fresh pair would mean reinstalling the new public key everywhere, which is unnecessary work.

The key is sent to our server, processed, and deleted immediately — it is not stored or logged. But a private key is a credential and it does cross the network, so treat this as appropriate for test and lab keys. For a production key, run ssh-keygen -y -f ~/.ssh/id_ed25519 locally, or puttygen key.ppk -L for a PPK — neither sends anything anywhere.

The trailing user@host comment is a label, not part of the key material, and it is not always carried through when a public key is re-derived. It has no effect on authentication — you can edit it freely, and the fingerprint stays the same either way.

No. Extraction only reads the key; nothing is modified. The derived public key is identical to the original, so every server and Git host that already accepts it continues to work.

Yes, if the private key is encrypted. The key cannot be read past its encryption header without it, so extraction will fail with a passphrase error rather than produce a wrong result.

RSA, ECDSA and Ed25519, in OpenSSH/PEM or PuTTY PPK containers. If extraction fails on a key you believe is valid, check first that you pasted the whole file — including the BEGIN and END marker lines — and that no editor wrapped the base64 body.