Inspect saved SSH host records without connecting

Start with a copy and an explicit query

Select one saved UTF-8 known_hosts file or paste its contents. A selected file takes precedence over pasted text, so remove it before changing input mode. Enter the bare host and an integer port separately; no path, URL, username or SSH command is needed. The browser does not enumerate your home directory or read another local file.

The host is a literal query. Plain patterns ignore letter case, while salted hashes use the exact query bytes. A nondefault port becomes [host]:port, including brackets around IPv6. Different aliases or compressed IPv6 spellings can therefore require separate searches; the workspace does not resolve addresses or invent aliases.

Read matching rules before reading fingerprints

A comma-separated positive pattern is sufficient only when no matching negated pattern excludes the row. The wildcard record *.example,!blocked.example applies to demo.example but excludes blocked.example. All matching rows remain visible; the first match does not discard later revoked or CA records.

Check a reproducible example

The starter contains three records using one synthetic Ed25519 public key: an alias row, a wildcard row and a revoked row. Searching demo.example on port 22 produces three applicable records and one revoked marker. Searching blocked.example produces none in this starter, because the wildcard exclusion applies.

The parsed public-key SHA256 fingerprint identifies the key bytes. It is the same for all three starter rows, although their host patterns and markers differ. A matching fingerprint alone cannot establish the source of a saved record or the key currently offered by a server.

SHA256:ZkAslGjFiUHdGf/WUL8rQvkib4PTvQatUV0OUQSncCA

Keep unsupported keys and unmatched keys distinct

Matching ssh-rsa and ssh-ed25519 keys are structurally decoded before fingerprinting. A damaged matching blob or another matching key type rejects the complete result, rather than producing an invented fingerprint. Unmatched key blobs remain in JSON with an explicit unvalidated status; scanning for one host does not certify every record in the file.

Physical lines include blank lines and comments, so line numbers still refer to the supplied copy. rawLine retains the original record spelling and spacing. Marker meanings, positive matches and negated matches are preserved separately from the summarized table.

Save a complete report and recover from errors

The table previews up to200 matching rows on 100-row pages. The downloaded JSON contains every record and match; CSV contains every matching original line and fingerprint. The on-page JSON is a bounded preview, so use downloads for a large handoff and compare the total count with the receiving application.

Inputs are bounded to1MiB,10,000 physical lines,8,192 bytes per line and32 patterns per row. Pattern comparisons and combined output bytes are also bounded. A limit or invalid matching key fails atomically. Correct the indicated input, rerun, and inspect the new report before acting on information from an older copy.

• Keep the source known_hosts copy with the report.
• Check the exact hostname spelling and nondefault port.
• Read every revoked or CA marker; do not turn presence into a trust approval.
• Compare the parsed fingerprint with separately trusted key evidence.
• Treat zero matches as a lookup result, with no permission or security conclusion.