The fastest online SSH checker — audit any SSH server for weak ciphers, outdated algorithms, and known vulnerabilities like Terrapin (CVE-2023-48795), SWEET32, and Logjam in seconds.
pip install ssh-audit then restart.
Enter a public hostname or IP. Port 22 is the default SSH port. Scans run server-side using ssh-audit by Joe Testa.
Our free SSH checker connects to your server on the specified port and negotiates the SSH handshake to enumerate all supported algorithms, cross-referencing each against known weaknesses, CVEs, and 2026 best-practice recommendations.
Works with any public SSH server — OpenSSH, Dropbear, Cisco, Juniper, and more. Supports custom ports.
The SSH scanner tests KEX, host key, encryption cipher, and MAC algorithms — typically completing in 10–30 seconds. Detects weak credentials, deprecated algorithms, and Terrapin vulnerability.
Receive an A–F grade, a 0–100 score, CVE vulnerability list, and exact sshd_config lines to fix every issue found. Export a printable PDF report.
An SSH audit is a security assessment of an SSH server's configuration. It checks which cryptographic algorithms — key exchange, ciphers, MACs, and host keys — are enabled and flags weak or deprecated ones. It also detects known CVE vulnerabilities such as Terrapin (CVE-2023-48795), SWEET32, and Logjam. The ssh-audit tool by Joe Testa automates this process and is what powers sshaudit.online.
Terrapin (CVE-2023-48795) is a prefix truncation attack against the SSH Binary Packet Protocol. It allows a man-in-the-middle attacker to silently drop or modify the first few messages of an SSH connection, potentially downgrading security features. It affects ChaCha20-Poly1305 and CBC-ETM ciphers. Fix: upgrade to OpenSSH 9.6 or later with strict key exchange enabled.
Use the free SSH cipher scanner above. Enter your server IP or hostname and click Audit. It lists every cipher, MAC, and key exchange algorithm your server supports and flags weak ones like 3des-cbc, arcfour, hmac-md5, hmac-sha1, diffie-hellman-group1-sha1, and ssh-dss with specific removal recommendations.
To harden your SSH server: disable weak ciphers and algorithms in /etc/ssh/sshd_config, use only curve25519-sha256 for key exchange, enable only chacha20-poly1305 and aes256-gcm ciphers, use only hmac-sha2-256-etm and hmac-sha2-512-etm MACs, and disable password authentication. See our 2026 SSH hardening guides for ready-to-use sshd_config snippets for Ubuntu, Debian, Rocky Linux, and Amazon Linux.
Disable these weak algorithms: KEX: diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, ecdh-sha2-nistp256. Host keys: ssh-dss, ssh-rsa (prefer rsa-sha2-512). Ciphers: 3des-cbc, arcfour, aes128-cbc. MACs: hmac-md5, hmac-sha1, umac-64. Use our SSH checker to get a personalised list for your server.
ssh-audit is an open-source SSH server and client auditing tool created by Joe Testa (github.com/jtesta/ssh-audit). It analyses SSH configurations for weak algorithms, known vulnerabilities, and compliance issues. sshaudit.online provides a free web interface to run ssh-audit against any public SSH server without installing any software.
Yes. sshaudit.online is a fully browser-based online SSH test tool. Enter any public IP or hostname, click Audit, and get a full SSH security report in seconds. No downloads, no registration, no API keys required.
Scan your server online for free using the tool above. For hardening your sshd_config on Debian 12 or Ubuntu 24.04/22.04, see the ready-to-use SSH hardening guides. Alternatively install ssh-audit locally: pip install ssh-audit then ssh-audit localhost.
An SSH vulnerability test checks your server for known security weaknesses including Terrapin (CVE-2023-48795), SWEET32 (CVE-2016-2183), Logjam (CVE-2015-4000), DHEat, and deprecated algorithm usage. sshaudit.online runs a free SSH vulnerability test in under 30 seconds — no installation required.
No. sshaudit.online does not store, log, or share your scan results, server hostname, or IP address. Scans are ephemeral — they run server-side and the results are streamed directly to your browser in real time.