devopscodepro
Language
Productized services
Infrastructure AuditRisks, costs and quick wins — mapped in two weeks.Cloud Migration & IaCTerraform, CI/CD and a zero-downtime cutover.Monitoring-as-a-ServiceAlerting, on-call and incident response.Fractional DevOpsA senior engineer in your team, part-time.
Not sure where to start? The audit answers that.Request a quote →
server-assisted · every other tool runs in your browserAll 41 tools →
Infrastructure AuditCloud Migration & IaCMonitoring-as-a-ServiceFractional DevOps
ContactLog in
Request a quote
Theme
Language
Runs entirely in your browser — nothing leaves this page.

SSH keys

Ed25519 keypairs generated in the browser, fingerprints and format conversion for any public key, plus authorized_keys restriction and hashed known_hosts builders.

Paste a public key to see its type, fingerprint and both text formats.
These tools show symptoms. A full infrastructure audit finds the causes — risks, cost leaks and single points of failure, mapped in two weeks.
Request a quote →

Working with SSH keys, not against them

Four related jobs in one place. Inspect: paste any public key — OpenSSH one-liner or RFC 4716 block, an authorized_keys line with options works too — and get its type, size, SHA-256 fingerprint and both text formats. Generate: a fresh Ed25519 pair created in your browser with the Web Crypto CSPRNG; the private key is assembled in the standard openssh-key-v1 container that ssh-keygen and every OpenSSH accept.

The authorized_keys builder is where the security value sits: a deploy key that can only run one command from one network, with no TTY and no forwarding, is a fundamentally smaller risk than a bare key line. The builder assembles from=, command=, expiry-time= and the no-* flags in the exact syntax sshd expects.

The known_hosts builder produces hashed entries (HashKnownHosts format) — the form that doesn't leak your infrastructure's hostnames if the file ever escapes.

Is generating a key in a browser safe?

The randomness comes from the same CSPRNG native tools use, and nothing leaves the page — verifiable with the network tab. The honest caveat is the environment: a machine with malicious extensions has no trustworthy place to generate keys, browser or terminal alike. For high-value keys, prefer a hardware token.

Why Ed25519 and not RSA?

Ed25519 is the current OpenSSH default: keys are 68 characters instead of hundreds, signatures are faster, and there are no parameter choices to get wrong. RSA remains for legacy systems that predate it — if you need one, ssh-keygen -t rsa -b 4096 is the command.

What does a forced command actually enforce?

Whatever the client asks to run, sshd runs your command= instead — the original request lands in SSH_ORIGINAL_COMMAND for the script to inspect. Combined with no-pty and no-port-forwarding it turns a key into a single-purpose credential, which is exactly what automation keys should be.

Why hash known_hosts entries?

A plain known_hosts is a map of every host you connect to — useful reconnaissance if a laptop or backup leaks. Hashed entries still verify hosts exactly the same way but reveal nothing when read.

Related tools: Password hashing, Hash & checksum and Certificate decoder.