known_hosts decoder
Paste ~/.ssh/known_hosts. Every entry is decoded and
its key rated — and if the file is hashed, you can still ask whether a
particular host is in it.
Why hashed entries cannot simply be listed
A line beginning |1| stores HMAC-SHA1(salt,
hostname) rather than the hostname. That is one-way: this page cannot
show you what is in a hashed file, and neither can anything else. It can only
answer “is this specific host in here?” — which is why there is a box
for the hostname above.
That asymmetry is the entire point. HashKnownHosts yes means
someone who steals your laptop gets a list of fingerprints instead of a map of
every machine you administer. It costs you nothing except the ability to read
your own file, which is what this page gives back.
Two markers change a line's meaning completely:
@cert-authority makes it a CA — any host with a certificate signed
by that key is trusted, which is how you avoid an entry per machine.
@revoked makes OpenSSH refuse the key outright.
When the big warning appears
REMOTE HOST IDENTIFICATION HAS CHANGED means the key is not the one you saw
last time. Usually the server was rebuilt; sometimes it is not. The reflex to
avoid is ssh-keygen -R followed by an unexamined yes,
which is indistinguishable from accepting an attacker. Confirm the new
fingerprint through a channel the SSH connection does not control — a console,
a provider dashboard, an SSHFP record — and only then remove
the old entry.