Enter Key:

Supported are X.509 certificates (CRT), Certificate Signing Requests (CSR), PEM public and private keys according to PKCS #1 and PKCS #8, and SSH public keys. (While supported, uploading private keys is obviously discouraged for production keys.)

Fill with test data



Success Stories

Vulnerabilities

The badkeys service checks for these vulnerabilities:

Furthermore, the following discouraged practices are checked:

You can find badkeys on Mastodon.



This project was created by Hanno Böck. The code checking for vulnerable keys is available on Github.

badkeys is currently funded through the NGI0 Core Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101092990.

This work was initially funded in 2022 by Industriens Fond through the CIDI project (Cybersecure IOT in Danish Industry) and the Center for Information Security and Trust (CISAT) at the IT University of Copenhagen, Denmark.