SSH Known Hosts Workbench

How to use SSH Known Hosts Workbench

Inspect host-key records, test a declared host pattern/hash lookup or create a separately hashed known_hosts copy. Retain CA/revoked markers and calculate public-key fingerprints. Exact-host hashing uses OpenSSH version-1 salted HMAC-SHA1; wildcard or negated records are refused when hashing.

1. Provide known hosts file text, exact host lookup.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• 200 KB of ASCII text, 200 physical lines, 8,192 bytes per key line and 50 patterns per line. Pattern matching uses bounded dynamic programming with a 2,000,000-cell total budget.
• Public key structures are limited to RSA, Ed25519 and ECDSA nistp256. Fingerprints describe supplied bytes; mathematical key validity, certificates and ownership are not established.
• Lookup lowercases the explicitly supplied ASCII host/[host]:port string. No DNS, host alias, canonical-name or port inference occurs. Plain matching supports * and ? with negation precedence; hashed records require canonical |1| salt/hash syntax.
• Hash exact hosts generates random independent 20-byte salts and up to 500 output records. Existing valid hashes are retained; comments and key bytes remain visible. Hashing obscures exact host strings but does not make the entire file anonymous.
• Inputs are processed on this device and are not automatically saved or uploaded.