Free · No Registration · Powered by ssh-audit

SSH Audit Online

The fastest online SSH checker — audit any SSH server for weak ciphers, outdated algorithms, and known vulnerabilities like Terrapin (CVE-2023-48795), SWEET32, and Logjam in seconds.

→ View a sample SSH audit report

ssh-audit not installed. Run pip install ssh-audit then restart.
Server Audit
Client Audit

Enter a public hostname or IP. Port 22 is the default SSH port. Scans run server-side using ssh-audit by Joe Testa.

Auditing
Testing cryptographic algorithms — this takes 10–30 seconds

/100
Scanning…
0
Critical
0
Warnings
0
Passed
0
Total
gen General Information
key Host-Key Algorithms
kex Key Exchange Algorithms
enc Encryption Algorithms (Ciphers)
mac MAC Algorithms
🛡️

2026 SSH Vulnerabilities

About This Tool

How the Online SSH Audit Works

Our free SSH checker connects to your server on the specified port and negotiates the SSH handshake to enumerate all supported algorithms, cross-referencing each against known weaknesses, CVEs, and 2026 best-practice recommendations.

1
Enter your server hostname or IP

Works with any public SSH server — OpenSSH, Dropbear, Cisco, Juniper, and more. Supports custom ports.

2
Instant SSH algorithm scan

The SSH scanner tests KEX, host key, encryption cipher, and MAC algorithms — typically completing in 10–30 seconds. Detects weak credentials, deprecated algorithms, and Terrapin vulnerability.

3
Get your SSH security grade

Receive an A–F grade, a 0–100 score, CVE vulnerability list, and exact sshd_config lines to fix every issue found. Export a printable PDF report.

Frequently Asked Questions

What is an SSH audit?

An SSH audit is a security assessment of an SSH server's configuration. It checks which cryptographic algorithms — key exchange, ciphers, MACs, and host keys — are enabled and flags weak or deprecated ones. It also detects known CVE vulnerabilities such as Terrapin (CVE-2023-48795), SWEET32, and Logjam. The ssh-audit tool by Joe Testa automates this process and is what powers sshaudit.online.

What is the Terrapin SSH vulnerability (CVE-2023-48795)?

Terrapin (CVE-2023-48795) is a prefix truncation attack against the SSH Binary Packet Protocol. It allows a man-in-the-middle attacker to silently drop or modify the first few messages of an SSH connection, potentially downgrading security features. It affects ChaCha20-Poly1305 and CBC-ETM ciphers. Fix: upgrade to OpenSSH 9.6 or later with strict key exchange enabled.

How do I check if my SSH server has weak ciphers?

Use the free SSH cipher scanner above. Enter your server IP or hostname and click Audit. It lists every cipher, MAC, and key exchange algorithm your server supports and flags weak ones like 3des-cbc, arcfour, hmac-md5, hmac-sha1, diffie-hellman-group1-sha1, and ssh-dss with specific removal recommendations.

How do I harden my SSH server in 2026?

To harden your SSH server: disable weak ciphers and algorithms in /etc/ssh/sshd_config, use only curve25519-sha256 for key exchange, enable only chacha20-poly1305 and aes256-gcm ciphers, use only hmac-sha2-256-etm and hmac-sha2-512-etm MACs, and disable password authentication. See our 2026 SSH hardening guides for ready-to-use sshd_config snippets for Ubuntu, Debian, Rocky Linux, and Amazon Linux.

What SSH algorithms should I disable in 2026?

Disable these weak algorithms: KEX: diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, ecdh-sha2-nistp256. Host keys: ssh-dss, ssh-rsa (prefer rsa-sha2-512). Ciphers: 3des-cbc, arcfour, aes128-cbc. MACs: hmac-md5, hmac-sha1, umac-64. Use our SSH checker to get a personalised list for your server.

What is ssh-audit by Joe Testa?

ssh-audit is an open-source SSH server and client auditing tool created by Joe Testa (github.com/jtesta/ssh-audit). It analyses SSH configurations for weak algorithms, known vulnerabilities, and compliance issues. sshaudit.online provides a free web interface to run ssh-audit against any public SSH server without installing any software.

Can I test SSH online without installing anything?

Yes. sshaudit.online is a fully browser-based online SSH test tool. Enter any public IP or hostname, click Audit, and get a full SSH security report in seconds. No downloads, no registration, no API keys required.

How do I audit SSH on Debian or Ubuntu?

Scan your server online for free using the tool above. For hardening your sshd_config on Debian 12 or Ubuntu 24.04/22.04, see the ready-to-use SSH hardening guides. Alternatively install ssh-audit locally: pip install ssh-audit then ssh-audit localhost.

What is an SSH vulnerability test?

An SSH vulnerability test checks your server for known security weaknesses including Terrapin (CVE-2023-48795), SWEET32 (CVE-2016-2183), Logjam (CVE-2015-4000), DHEat, and deprecated algorithm usage. sshaudit.online runs a free SSH vulnerability test in under 30 seconds — no installation required.

Does SSH audit store my server data?

No. sshaudit.online does not store, log, or share your scan results, server hostname, or IP address. Scans are ephemeral — they run server-side and the results are streamed directly to your browser in real time.