SSH Key Pair Matcher
GitHub

Check whether an SSH public key matches a private key

Paste or load an SSH public key and an OpenSSH private key to compare their public components locally in your browser.

Paste, drop, or choose one OpenSSH public key file.

Paste, drop, or choose one OpenSSH private key file.

Add both keys to enable checking.

How it works

An OpenSSH private-key file also contains its public key. The matcher reads that public component and compares it with the public key you provide. Everything runs in this tab, including format checks and fingerprints. No signing or server connection is involved.

Supported formats

The matcher accepts one OpenSSH public key line and one private key in the OpenSSH v1 container format. Supported algorithms are:

  • Ed25519 (ssh-ed25519)
  • RSA (ssh-rsa)
  • ECDSA P-256, P-384, and P-521 (ecdsa-sha2-nistp256/384/521)

PKCS#1, PKCS#8, PEM EC, PuTTY PPK, OpenSSH certificates, FIDO security-key formats, and multi-key private containers are not accepted in version 1.

Encrypted private keys

OpenSSH stores the public component outside the encrypted part of a private-key file. The matcher can read it without a passphrase. Your private key stays encrypted.

This does not decrypt the private key, validate its passphrase, or prove that the file can be used to authenticate.

Check with ssh-keygen

OpenSSH can derive a public key from a private-key file locally. Use file paths so key material does not enter your shell history: 

ssh-keygen -y -f ~/.ssh/id_ed25519 > /tmp/id_ed25519.derived.pub
ssh-keygen -lf /tmp/id_ed25519.derived.pub -E sha256
ssh-keygen -lf ~/.ssh/id_ed25519.pub -E sha256

If the two SHA-256 fingerprints are identical, the keys match. An encrypted private key will prompt for its passphrase in your terminal. Delete the temporary derived public-key file when you are finished.

Reading fingerprints

A fingerprint is a short digest of the complete binary public-key blob, including its algorithm fields. It is easier to compare than a long base64 key. Matching SHA-256 fingerprints identify the same public component; they do not reveal the private key.

SHA-256 is the primary modern fingerprint. MD5 is displayed only to compare with older OpenSSH output and inventories. It is not a security recommendation.

Troubleshooting

Wrong field or format
Check that the public field begins with a supported SSH algorithm and the private field contains an OpenSSH private key, not a PEM or PPK file.
Malformed key data
Re-copy the complete key from its file. Damaged base64, missing armor lines, unexpected whitespace, and trailing binary fields are rejected.
Valid keys, different pair
Two keys may use the same algorithm and size but still have different fingerprints. Select the matching .pub file or derive it again with ssh-keygen -y.

Privacy

Your keys stay in this tab. The comparison makes no network requests, and the page loads no third-party scripts, analytics, or advertising.

Key material and theme choices are not persisted in cookies, browser storage, IndexedDB, Cache Storage, URLs, or history. A production Content Security Policy blocks outbound connections and form actions. Browser tests audit the network and persistence surfaces during every tool action.

Wipe keys clears the inputs, errors, and derived results from this tab. It cannot erase copies held by your clipboard, browser extensions, developer tools, screenshots, operating-system memory, or swap.

You can read the code and tests in the public GitHub repository. The project is released under the MIT License.

Common questions

Can I check an encrypted private key without its passphrase?

Yes, when it uses the OpenSSH v1 private-key format. Its outer container exposes the public component needed for comparison; the encrypted private payload is not opened.

Does a matching pair prove the key is safe?

No. A match proves only that both files contain the same public component. It does not assess passphrase strength, file permissions, compromise, revocation, or whether a server authorizes that public key.

Why is my PEM or PuTTY key rejected?

Version 1 deliberately accepts only OpenSSH v1 private-key containers. If OpenSSH can read your local key, use ssh-keygen -y -f /path/to/private-key to derive its public key, or convert a backup locally before using this tool.

Is comparing only the algorithm and key size enough?

No. Many unrelated keys share an algorithm and size. The complete public-key blobs must match. Comparing their complete fingerprints also identifies the same public component.

Are provided keys uploaded or saved?

No. Matching runs in this tab, and the application does not upload or store the provided values. Use Wipe keys when you are finished to clear the form and results from the tab.