Home › Formats › .known_hostsID
What is a .known_hosts file?
A known_hosts file records the public keys of SSH servers you have connected to, so your client can warn you if a server’s identity ever changes.
- Did you know
- The scary "remote host identification has changed" warning comes straight from known_hosts, guarding against someone impersonating a server you trust.
- Modern OpenSSH can hash the hostnames in known_hosts, so a stolen file does not reveal which servers you actually connect to.
- The file pins each server's key on first contact, a trust-on-first-use model that protects every later connection from impersonation.
- What Analyser reads
- Identify and read more security and forensics files: OpenPGP messages/keys/signatures (.pgp/.gpg/.sig - armor type, packet walk, key algorithm and user ID, secret-key warning), YARA rules, Snort/Suricata IDS rules, STIX/OpenIOC threat intel, Fiddler captures (.saz), 1Password exports (.1pux), Apple Keychain, KeePass 1.x (.kdb), Microsoft keys (.pvk) and AFF/AFF4 forensic images.
- Depth of analysis
- .known_hosts is an identification-grade format: Analyser recognises it from its bytes and decodes the header metadata it carries, rather than opening it in a full viewer. Formats that do get a full viewer are marked "Full" on the formats page.
- Open a .known_hosts file
- Drag a .known_hosts file onto the Analyser home page (or tap to pick one). It is identified entirely in your browser - nothing is uploaded, there is no account, and it works offline once installed.