Conchshell
ENRU
Download

Tools

Six small things that were useful enough to build while working on the client, and are more useful published than kept. All of them run entirely in your browser, need no account, and are not gated behind anything.

SSH key fingerprints
Paste .pub files, authorized_keys or known_hosts and get SHA256 and MD5 fingerprints exactly as ssh-keygen -lf prints them, certificates included. Hashed known_hosts entries can be tested against a host you name.

Open the fingerprint tool

SSH public key checker
Paste a public key and get the algorithm, the real key size, the SHA256 fingerprint exactly as ssh-keygen prints it, and a grade from A to D with the reason. A private key pasted by mistake is refused rather than processed.

Open the key checker

ssh-keygen command builder
Choose the key type, size, comment and KDF rounds, security-key options included, and get the exact ssh-keygen command with every flag explained, plus the ~/.ssh/config block. It never asks for your passphrase.

Open the command builder

PPK to OpenSSH converter
Turn a PuTTY .ppk private key into the OpenSSH format, or an OpenSSH key into a .ppk for PuTTY, with its passphrase kept, changed or removed. Built on the PPK parser Conchshell itself uses, compiled to WebAssembly.

Open the converter

SSH config linter
Paste your ~/.ssh/config and get the lines worth changing: legacy ciphers, MACs on MD5 and SHA-1, a key exchange with no curve25519, host-key checking turned off, and directives silently overridden by an earlier line. Generates a corrected config too.

Open the linter

RDP file viewer
Open a .rdp file and read every setting in plain words before Windows applies them, with warnings for shared drives, the clipboard, smart cards, RemoteApp programs and gateways.

Open the RDP file viewer

Why they run in the browser

All six take input that people are right to be careful about. A configuration file names your hosts, your users and your jump boxes; a public key is meant to be public but arrives from the same directory as the private one; a .ppk file is a private key; a .rdp file can carry a saved password. None of it has any business on someone else's server for the sake of work that takes a moment locally.

So no tool page sends what you paste anywhere, and none carries analytics. The scripts of the other five have no fetch, no XMLHttpRequest and no form submission in them; the converter’s only fetch is for its own WebAssembly file, made as the page opens and before you paste anything. Going without analytics costs us the usage statistics for these pages, and it is worth it: the promise is checkable in ten seconds with the network tab open, rather than being something you have to take on trust.

How they are tested

The key checker and the fingerprint tool are verified against ssh-keygen itself. For the key checker, five real key types are generated and both the bit count and the SHA256 fingerprint are compared with what ssh-keygen -lf prints. For the fingerprint tool, 50 key files of every type OpenSSH reads, certificates included, plus an authorized_keys and a hashed known_hosts: the SHA256 and MD5 output, the randomart and every host lookup match ssh-keygen’s own. Agreement with an outside authority is a stronger test than any assertion written by the person who wrote the parser.

The command builder is tested by running what it builds: for macOS and Linux, every Ed25519, ECDSA and RSA choice it offers went through ssh-keygen 10.2 in a sandbox, and the key that came out was checked for its type, size, comment, passphrase and KDF rounds. Security-key commands are the exception: making that key needs the token, so for them the test only confirms that ssh-keygen accepts every option. The RDP file viewer is tested on files in each encoding Windows writes and on a file built to trip every warning.

The linter is checked against a rule that is easy to state and easy to fail: the config it generates must pass its own checks with no errors and no warnings.

The converter is checked against the two programs that define the formats: every OpenSSH key it writes is read back by ssh-keygen, every .ppk is loaded in full by PuTTYgen, and an unencrypted .ppk comes out byte for byte the same as the one PuTTYgen writes.

That testing has already been worth it. It caught a truncated key being graded A — an SSH key body is a run of length-prefixed fields, so a key cut short often still parses cleanly — and it caught the linter advising you to add an IdentityFile to an empty file.

Read next

Download Conchshell free