Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.

SSH Key Converter

or drop the key file anywhere on this page

How it works

1

Paste (or drop) the key: an OpenSSH private key converts to PEM, a PEM private key converts to OpenSSH, a public line gets fingerprinted.

2

If a PEM key is encrypted, enter its passphrase; optionally set the comment for the output.

3

Click Convert, verify the fingerprint chip, and download the converted key and its public line.

About this tool

SSH keys come in two dialects that refuse to meet: OpenSSH’s own container (BEGIN OPENSSH PRIVATE KEY) and the PEM/PKCS#8 form (BEGIN PRIVATE KEY) that openssl, cloud consoles and TLS libraries expect. Moving between them normally means ssh-keygen incantations on a machine that has one — this converter does it in your browser, in either direction, for Ed25519, RSA and ECDSA P-256/P-384 keys.

Paste an authorized_keys public line instead and you get its SHA256 fingerprint — the same value ssh-keygen -lf prints and servers write to their logs, handy for matching a key to an audit trail.

100% private

The key is parsed, converted and re-encoded entirely in this tab — nothing is uploaded, and there is no server involved. Passphrase-protected OpenSSH keys are deliberately not decrypted here (their bcrypt protection is impractical in a browser); strip the passphrase locally with ssh-keygen -p first.

Frequently asked questions

Which direction do I need?

If a tool says "invalid PEM" or "unsupported key format" about your id_ed25519/id_rsa file, convert OpenSSH → PEM. If ssh or an SSH client rejects a .pem key from a cloud console or CA, convert PEM → OpenSSH. The content of the key never changes — only its packaging.

Why does my converted key have no passphrase?

Conversion preserves the key material, not the wrapper — output is written unencrypted so every consumer can read it. Add a passphrase afterwards with ssh-keygen -p -f <file>, and keep permissions at 600 either way.

The fingerprints match — what does that prove?

The SHA256 fingerprint is computed from the public key, so a matching fingerprint before and after conversion proves the converted file is the same key, just re-packaged. It is also the value to compare against server logs and GitHub’s key list.

Related tools

Popular right now