SSH Key Pair Matcher
GitHub

Browser-local SSH utility

Check whether an SSH public key matches a private key

Paste or load an SSH public key and an OpenSSH private key to compare their public components locally in your browser.

Your keys never leave this browser

Local-only · No uploads · No storage. Matching happens in this tab. Open source — inspect the code.

Paste, drop, or choose one OpenSSH public key file.

Paste, drop, or choose one OpenSSH private key file.

Add both keys to enable checking.

Understand the comparison

How browser-local SSH key matching works

An SSH private key contains enough public information to identify its pair. This tool parses the public key blob from each provided value, validates its structure, and compares the two blobs in this tab. It does not generate a signature, contact a server, or need access to the private key’s secret values.

Supported key types and formats

The matcher accepts one OpenSSH public key line and one private key in the OpenSSH v1 container format. Supported algorithms are:

  • Ed25519 (ssh-ed25519)
  • RSA (ssh-rsa)
  • ECDSA P-256, P-384, and P-521 (ecdsa-sha2-nistp256/384/521)

PKCS#1, PKCS#8, PEM EC, PuTTY PPK, OpenSSH certificates, FIDO security-key formats, and multi-key private containers are not accepted in version 1.

Why encrypted OpenSSH private keys can be matched

An encrypted OpenSSH private-key file still stores its public key blob in the unencrypted outer container. The secret private payload remains encrypted. The matcher reads only that public component, so it can identify the corresponding public key without asking for or testing a passphrase.

This does not decrypt the private key, validate its passphrase, or prove that the file can be used to authenticate.

Check a key pair manually with ssh-keygen

OpenSSH can derive a public key from a private-key file locally. Use file paths so key material does not enter your shell history: 

ssh-keygen -y -f ~/.ssh/id_ed25519 > /tmp/id_ed25519.derived.pub
ssh-keygen -lf /tmp/id_ed25519.derived.pub -E sha256
ssh-keygen -lf ~/.ssh/id_ed25519.pub -E sha256

If the two SHA-256 fingerprints are identical, the keys match. An encrypted private key will prompt for its passphrase in your terminal. Delete the temporary derived public-key file when you are finished.

What SSH fingerprints mean

A fingerprint is a short digest of the complete binary public-key blob, including its algorithm fields. It is easier to compare than a long base64 key. Matching SHA-256 fingerprints identify the same public component; they do not reveal the private key.

SHA-256 is the primary modern fingerprint. MD5 is displayed only to compare with older OpenSSH output and inventories. It is not a security recommendation.

Common parse and mismatch errors

Wrong field or format
Check that the public field begins with a supported SSH algorithm and the private field contains an OpenSSH private key, not a PEM or PPK file.
Malformed key data
Re-copy the complete key from its file. Damaged base64, missing armor lines, unexpected whitespace, and trailing binary fields are rejected.
Valid keys, different pair
Two keys may use the same algorithm and size but still have different fingerprints. Select the matching .pub file or derive it again with ssh-keygen -y.

Privacy and open-source design

How privacy is enforced

The matcher has no server or API: parsing, fingerprints, and comparison all run in the loaded browser tab. It loads no runtime third parties, analytics, advertising, or remote assets.

Key material and theme choices are not persisted in cookies, browser storage, IndexedDB, Cache Storage, URLs, or history. A production Content Security Policy blocks outbound connections and form actions. Browser tests audit the network and persistence surfaces during every tool action.

Wipe keys clears the inputs, errors, and derived results from this tab. It cannot erase copies held by your clipboard, browser extensions, developer tools, screenshots, operating-system memory, or swap.

Audit the implementation, tests, privacy constraints, and MIT license in the public GitHub repository.

Focused answers

SSH key pair matcher FAQs

Can I check an encrypted private key without its passphrase?

Yes, when it uses the OpenSSH v1 private-key format. Its outer container exposes the public component needed for comparison; the encrypted private payload is not opened.

Does a matching pair prove the key is safe?

No. A match proves only that both files contain the same public component. It does not assess passphrase strength, file permissions, compromise, revocation, or whether a server authorizes that public key.

Why is my PEM or PuTTY key rejected?

Version 1 deliberately accepts only OpenSSH v1 private-key containers. If OpenSSH can read your local key, use ssh-keygen -y -f /path/to/private-key to derive its public key, or convert a backup locally before using this tool.

Is comparing only the algorithm and key size enough?

No. Many unrelated keys share an algorithm and size. The complete public-key blobs—or their complete fingerprints—must match.

Are provided keys uploaded or saved?

No. Matching runs in this tab, and the application does not upload or store the provided values. Use Wipe keys when you are finished to clear the form and results from the tab.