Free OpenSSH client config checker
An SSH config linter that finds what SSH does not mention.
Paste or open your ~/.ssh/config. This free SSH config checker catches duplicate hosts, unsafe options, weak algorithms, and ordering mistakes before they waste your time.
Nothing is uploaded. The check stays in this browser.
23 GitHub starsReplace the example below or open your ~/.ssh/config file.
7 things worth checking
- About this rule
- About this rule
- About this rule
- About this rule
- About this rule
- About this rule
- About this rule
Browser mode checks the content you provide. It cannot read your computer.
THE USEFUL PART
What this SSH config linter checks.
The browser checks the OpenSSH rules that only need your configuration text. Each finding explains the problem and points back to the relevant line.
INVALID_VALUEInvalid values
Checks ports, counters, durations, masks, DSCP values, and documented option names.
DUP_HOSTDuplicate hosts
Finds repeated Host patterns that make a config harder to reason about.
WILDCARD_ORDERWildcard ordering
Warns when a specific host appears after Host * and may inherit unexpected values.
INSECURE_OPTUnsafe options
Flags disabled host verification and broad agent or X11 forwarding.
WEAK_ALGOWeak algorithms
Recognizes deprecated ciphers, MACs, key exchange, and signature algorithms.
DUP_DIRECTIVERepeated directives
Shows values repeated in the same scope when OpenSSH only uses the first one.
UNSAFE_CTRL_PATHControlPath collisions
Checks whether shared connection paths identify host, port, and user.
NEGATED_HOSTNegated-only hosts
Finds Host blocks that can never produce a positive match.
PROXY_CONFLICTConflicting proxy methods
Shows when ProxyCommand and ProxyJump compete in one scope.
LOCAL_COMMAND_DISABLEDIgnored local commands
Warns when LocalCommand is present but not enabled.
INVALID_TOKENInvalid percent tokens
Checks placeholders against each directive’s supported tokens.
The same checks wherever the config changes.
BROWSER AND CLI
A quick check here. The complete check on your machine.
The website is for fast feedback. The open source CLI follows Include files, detects cycles, and can verify local paths.
In this browser
- No installation
- No upload
- 17 content-based rules
- Works on phones and desktops
With sshconfig-lint
- Nested Include resolution
- IdentityFile existence checks
- Text, JSON, SARIF, and GitHub output
- Language server for editors
Use the complete linter
Install it with Homebrew, Cargo, AUR, or a prebuilt binary.
brew install Noah4ever/tap/sshconfig-lint