SSH Key & CSR Decoder
Paste either an OpenSSH public key line or a PEM certificate signing request and get back the details without shelling out to ssh-keygen -lf or openssl req -text — the fingerprint and key type for an SSH key, or the subject fields and key algorithm for a CSR. Parsing happens entirely client-side; nothing is uploaded.
What you're actually looking at with an SSH key fingerprint
An OpenSSH public key is a Base64 blob wrapping a small binary structure — the algorithm name, then the key material itself, each length-prefixed. The fingerprint isn't some separate value stored in the key; it's just the SHA-256 hash of that decoded binary blob, presented as Base64. It exists because comparing two multi-hundred-character Base64 key strings by eye is how transcription errors slip through — a fingerprint is short enough to actually read aloud and compare, which is exactly why ssh-keygen -lf shows it and why services like GitHub display it next to keys you've added.
Why this uses SHA-256, not the older MD5 format
Older tooling showed fingerprints as colon-separated MD5 hex pairs — you'll still see that format referenced in older docs and forum posts. OpenSSH switched its default to SHA-256 fingerprints back in version 6.8, and it's what modern tooling shows by default now. Given MD5 has known collision weaknesses, this only implements the SHA-256 form, which is the one you should actually be comparing against in current tooling anyway.
What a CSR actually contains, and why decoding one is worth doing
A Certificate Signing Request is a small, unsigned bundle — really just the Subject fields (CN, O, OU, C, and so on) plus the public key — sent to a Certificate Authority, which signs it into an actual certificate. Nothing about the CSR is secret, so decoding it and checking the fields is entirely safe. It's worth doing specifically before submitting a CSR to a CA or a request tracker: confirming the CN is actually the domain you meant, the Organization field wasn't left as boilerplate from a template, and the key size is what you expected are all things that are much cheaper to catch here than after a CA has already issued (and charged you for) a certificate with the wrong subject.
Reading the underlying format, briefly
A CSR is DER-encoded ASN.1 — a nested, self-describing binary structure of tag-length-value triplets, wrapped in PEM's Base64-with-headers envelope for easy copy-pasting. It's the same encoding family used for X.509 certificates themselves, so once ASN.1 makes sense for a CSR, reading a certificate's raw structure (via openssl x509 -text, for instance) stops looking like an opaque wall of hex.