SSH Public Key Format Converter

What does the SSH Public Key Format Converter do?

The SSH Public Key Format Converter transforms SSH public keys between OpenSSH single-line strings (ssh-ed25519 AAA...), IETF RFC 4716 (---- BEGIN SSH2 PUBLIC KEY ----), and SubjectPublicKeyInfo PKCS#8 PEM blocks (-----BEGIN PUBLIC KEY-----). It handles key comments, line wrapping, algorithm headers, and ASN.1 DER encodings without transmitting private material across external networks.

Core Concepts

Understanding SSH public key specifications and conversions:

• OpenSSH Format: Single-line string containing the algorithm identifier (ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256), Base64-encoded binary payload, and optional comment.
• RFC 4716 (IETF SSH2): Standardized multi-line block with 72-character line wrapping, comment headers, and boundary tags used by commercial SSH servers.
• PKCS#8 PEM: Standard ASN.1 SubjectPublicKeyInfo structure wrapped in 64-character PEM boundaries, required by OpenSSL, AWS KMS, and web cryptographic APIs.

How to use the tool?

1. Select Target Format: Choose your desired output format (RFC 4716, OpenSSH, or PEM).
2. Paste SSH Public Key: Paste your public key string into the input box or click Load Sample.
3. Convert & Copy: Click Convert SSH Key Format, then click Copy or Download to save the converted key.

Related Developer Utilities

If you work with SSH keys, certificates, and cryptographic encodings, explore these complementary tools:

• SSH Public Key Fingerprint Generator: Calculate SHA256 & MD5 SSH key fingerprints.
• SSH Config to Ansible Inventory Converter: Convert ~/.ssh/config to Ansible inventories.
• SSH Config to /etc/hosts Converter: Convert SSH config hosts into /etc/hosts aliases.
• Base64 Decoder: Decode generic Base64 strings into UTF-8 text.

REST API Integration

Blueutils provides a free REST API endpoint (POST https://blueutils.com/api/ssh/ssh-key-converter) to programmatically convert SSH public keys between OpenSSH, RFC 4716 (SSH2), and PEM formats.

API Request Parameters

API Request Payload Examples

cURL

curl -X POST https://blueutils.com/api/ssh/ssh-key-converter \
  -H "Content-Type: application/json" \
  -d '{
    "rawText": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 developer@workstation",
    "targetFormat": "rfc4716"
  }'

Python

import requests

url = "https://blueutils.com/api/ssh/ssh-key-converter"
payload = {
    "rawText": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 developer@workstation",
    "targetFormat": "rfc4716"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.json())

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String jsonPayload = """
            {
                "rawText": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 developer@workstation",
                "targetFormat": "rfc4716"
            }
            """;

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://blueutils.com/api/ssh/ssh-key-converter"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API Response Parameters

API Response Payload Examples

Success Response (HTTP 200 OK)

{
  "isValid": true,
  "format": "rfc4716",
  "converted": "---- BEGIN SSH2 PUBLIC KEY ----\nComment: \"developer@workstation\"\nAAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8\n---- END SSH2 PUBLIC KEY ----"
}

Validation Failure Response (HTTP 400 Bad Request)

{
  "isValid": false,
  "error": "Invalid OpenSSH public key: Expected at least 2 tokens (key type and Base64 encoded payload)."
}

Rate Limit Exceeded Response (HTTP 429 Too Many Requests)

{
  "error": "API rate limit exceeded. Please wait or contact support@blueutils.com."
}

Why use an API to convert SSH key formats?

Integrating the SSH Key Converter API into CI/CD pipelines, identity provisioning servers, or AI agent tool calling provides key benefits:

• Rapid Script Validation: Converts workstation OpenSSH keys into RFC 4716 or PEM blocks before uploading to Cisco network appliances or cloud PKI gateways.
• Optimized Token Efficiency for AI Agents: LLMs frequently introduce byte alignment errors when manually re-encoding ASN.1 DER and RFC 4716 headers. Calling the API converts keys deterministically without token consumption.
• Deterministic Accuracy Without Hallucinations: Ensures 100% compliant DER header wrapping and RFC 4716 boundary formatting.

Native Usage

How to convert SSH public key formats locally in terminal environments or scripts:

Windows (CMD / PowerShell)

:: Export OpenSSH key to RFC 4716 format
ssh-keygen -e -f %USERPROFILE%\.ssh\id_rsa.pub -m RFC4716 > id_rsa.ssh2

:: Export OpenSSH key to PKCS#8 PEM format
ssh-keygen -e -f %USERPROFILE%\.ssh\id_rsa.pub -m PEM > id_rsa.pem

Linux / Unix (Bash)

# Convert OpenSSH to RFC 4716 (SSH2)
ssh-keygen -e -f ~/.ssh/id_rsa.pub -m RFC4716 > id_rsa.ssh2

# Convert RFC 4716 to OpenSSH
ssh-keygen -i -f id_rsa.ssh2 > id_rsa.pub

# Convert OpenSSH to PKCS#8 PEM
ssh-keygen -e -f ~/.ssh/id_rsa.pub -m PKCS8 > id_rsa.pem

Python

Using Python cryptography:

from cryptography.hazmat.primitives.serialization import load_ssh_public_key, Encoding, PublicFormat

with open("/home/user/.ssh/id_rsa.pub", "rb") as f:
    key = load_ssh_public_key(f.read())

pem = key.public_bytes(
    encoding=Encoding.PEM,
    format=PublicFormat.SubjectPublicKeyInfo
)
print(pem.decode("utf-8"))

Java

Using Java:

import java.nio.file.Files;
import java.nio.file.Paths;

public class SshKeyConverterExample {
    public static void main(String[] args) throws Exception {
        String key = Files.readString(Paths.get(System.getProperty("user.home"), ".ssh", "id_rsa.pub"));
        System.out.println("Key algorithm: " + key.split(" ")[0]);
    }
}