A mirror for your SSH client

Every SSH connection begins with both sides announcing what cryptography they are willing to speak. Your client sends that list to every server you touch, and you have almost certainly never seen it.

ssh ssh.rocks

No account. No key required. Nothing stored. It prints a report and hangs up.

Everything it does

`ssh ssh.rocks`	the full report on your client
`ssh ssh.rocks scan <host>`	audit any SSH server, read-only — also in the browser
`ssh ssh.rocks hassh`	your client fingerprint, and what it gives away
`ssh ssh.rocks whoami`	everything this server learned before you logged in
`ssh ssh.rocks json`	the whole report as JSON, for scripting
`ssh ssh.rocks keys`	host key fingerprints — cross-check them here

What it tells you

What you offered

The full algorithm lists your client proposed — key exchange, ciphers, MACs, host key types — each one rated, with the reasoning. This is what you would accept, which matters more than what you used: an attacker who can influence the handshake aims at the weakest entry in the list, not the first one.

What you actually used

The algorithms this specific connection settled on. SSH takes the client's first choice the server also supports, so this is a fact about your preferences, not the server's.

The key you offered

Type, size, both fingerprints, and whether it is backed by hardware. If you are still carrying a 2048-bit RSA key from a laptop you no longer own, this is where you find out.

Terrapin

Whether your client supports strict key exchange, the fix for CVE-2023-48795. Without it, someone who can modify your TCP stream can delete messages from the start of a connection undetectably. It affects the modern, well-configured algorithms specifically.

In the browser

A web page cannot see your SSH handshake — that is the whole reason the terminal half exists. What it can do is read things you give it:

Server scanner — audit any SSH server and get ready-to-publish SSHFP records for it. Read-only: it never attempts authentication, so it leaves nothing in the target's auth log.
Public key inspector — paste a .pub file and get its type, size, fingerprints and a verdict.
ssh_config linter — paste your client config and see which lines are quietly weakening it, including the + modifier trap that re-enables broken ciphers while looking like hardening.
known_hosts decoder — rate every key in the file, and test whether a hashed file contains a given host. Hashing is one-way, so asking is the only thing anyone can do.
Algorithm reference — every algorithm this tool rates and the reasoning behind each verdict.
Host keys — this server's fingerprints, published here so you can verify the SSH side over a different channel.

Why you should not fully trust this page

You are reading a security assessment from a server you have no particular reason to believe. Everything here is checkable: the ratings are the published state of the art, and the tools that produced them (ssh -Q, ssh-keygen -l, nmap --script ssh2-enum-algos) run on your own machine. Treat this as a fast way to see something you could have measured yourself, not as an authority.