SSH Key Converter (OpenSSH / PEM / PuTTY PPK)
Keep key material local and preserve complete private-public format identity.
Try before you buy.
- Free preview: format labels with computed fingerprints and converted key material hidden.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the SSH Key Converter (OpenSSH / PEM / PuTTY PPK)
Convert supported plain OpenSSH, PEM PKCS#1/PKCS#8, SubjectPublicKeyInfo and RFC 4716 keys locally, or read PuTTY PPK v2 and unencrypted v3 and write authenticated v2. Private inputs can yield public output; public-only inputs cannot invent private components. RSA, DSA, named NIST elliptic curves and Ed25519 are handled with explicit validation.
Keys stay in this page’s memory on your device. Treat private output as sensitive and keep any protection it needs. An encrypted input the converter cannot read gets a clear error: it never strips protection or guesses bytes.
How to use it
- Paste a key or open a key file. Enter its passphrase only for a passphrase-protected PPK v2 file.
- Choose the output format: PKCS#1 is for RSA keys only; PKCS#8 suits any private key.
- For PPK v2 output, optionally enter a new passphrase. Other private outputs here are unencrypted.
- Check the algorithm and fingerprint, then copy or download the converted key with a Pro pass. Stop and clear or Reset removes the old result.
Formats and primary references
Wire and public formats follow RFC 4253 and RFC 4716, with OpenSSH private-key structure and the PuTTY PPK specification.
Limitations
- Encrypted OpenSSH bcrypt-PBKDF and encrypted PEM PBE inputs are explicitly unsupported here; decrypt locally with your trusted client first. This converter reads PPK v3 files only without a passphrase.
- Only plain RSA, DSA, P-256/P-384/P-521 and Ed25519 key material is handled; certificates, hardware/security-key handles, Ed448 and multi-prime RSA are separate formats.
- DSA and older protocol/hash encodings are format compatibility features, not recommendations for new authentication deployments.
- A matching format MAC/fingerprint is not proof of identity, key ownership or the security of the originating key.
- Reset clears the page, but a browser cannot promise to erase its memory securely. Paste real keys only into pages you trust, and never send them elsewhere.
Privacy
On this device: nothing is sent
Keys and passphrases stay in this page’s memory on your device: nothing is uploaded, looked up on a server or sent to an AI service, and the converter stores no key.
Frequently asked questions
What do I get without a pass?
Without a pass, SSH Key Converter (OpenSSH / PEM / PuTTY PPK) shows format labels with computed fingerprints and converted key material hidden. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Can a public key become a private key?
No. Public-only inputs can be converted among public formats but cannot produce private material.
Will the converter silently remove encryption?
No. Unsupported protected inputs fail explicitly. Supported PPK v2 decryption uses the password and authenticates the MAC before output; selecting an unencrypted private output is an explicit choice.
Are comments and fingerprints part of conversion?
Comments and supported RFC 4716 headers are retained with their format rules. SHA-256 fingerprints are computed from the complete SSH public blob.