Is PermitRootLogin prohibit-password safe?
It allows root with a key and never with a password. Many teams go further and set it to no, using sudo from a named account.
SSH Config Validator
Harden sshd before it goes live.
Paste an sshd_config or ssh_config and get findings with line numbers, severities, and plain-English reasons, plus a copy-ready hardened block and the exact ssh-keygen command for the key you need.
Loading the toolbox.
About 2ssh
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your data stays here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your data.
- Click the clear icon in the Network tab so that the log is empty.
- Use the tool with your own input.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and the tool keeps working.
Only two things can add a line to that log, and neither carries your data. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint, so a coding mistake could not quietly send your data elsewhere.
What Does 2ssh Check?
It knows more than sixty keywords for each dialect and checks values as well as names:
- Root login with a password, password authentication, empty passwords, and public keys switched off.
- MaxAuthTries, LoginGraceTime, ClientAliveInterval, and port ranges.
- Weak algorithms in Ciphers, MACs, KexAlgorithms, and host-key lists, including CBC ciphers, SHA-1 MACs, and ssh-rsa.
- Retired directives such as Protocol and UsePrivilegeSeparation, with the release that removed them.
- Client risks: StrictHostKeyChecking no, known_hosts sent to /dev/null, and agent forwarding to every host.
- Duplicate keys inside one block, where only the first value counts.
Why Does Order Matter in SSH Config Files?
Both sshd and ssh keep the first value they find for most settings. In ssh_config, that means specific Host blocks must come before Host *; put the wildcard first and its values override everything after it. The original 2ssh had this backwards and warned when Host * came last, which is the correct place. That rule now points the right way, and the hardened client block puts specific hosts first.
In sshd_config, the same rule means a hardening block belongs at the top of the file, before any Match block, so that nothing later can weaken it.
Which Key Type Should You Generate?
Ed25519 is the default choice: small keys, fast signatures, and support in OpenSSH since 6.5. Use ECDSA P-256 only where Ed25519 is unavailable, and RSA only for old servers, at 3072 or 4096 bits. The workbench composes the command with the right options, including KDF rounds that slow down guessing of the key passphrase, and strips characters from the comment that a shell would interpret.
The command runs on your own machine. A web page cannot and should not create your keys.
What Can a Static Check Not See?
2ssh reads text. It cannot see file permissions, the contents of authorized_keys, firewall rules, your OpenSSH version, or files pulled in with Include. Treat it as a careful reviewer, not a compliance certificate, and test any change with a second session open so a mistake cannot lock you out.
What Other Tools Are in the Checkers Lane?
- 2xml: Format, minify, and validate XML with line and column errors, namespace lint, and JSON conversion.
- 2jq: Try jq-style paths, pipes, select, length, and keys against JSON. A labeled subset, not full jq.
- 2dotenv: Find duplicate keys, empty values, and quoting bugs, diff against .env.example, and generate one.
- 2kbd: Press any key to see key, code, keyCode, location, and modifiers, with a copy-ready handler.
Elsewhere in the toolbox: 2uuid, 2gitignore, 2csp, 2htaccess, and more on the 2toolbox home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Why is aes128-cbc flagged?
CBC-mode ciphers have known weaknesses in SSH and are disabled by default in modern OpenSSH. Use chacha20-poly1305 or AES-GCM.
Does 2ssh upload my config?
No. The config is parsed on this page and never sent.
What does sntrup761x25519 mean?
A hybrid key exchange combining a post-quantum algorithm with X25519, the OpenSSH default since 9.0.