How to fix key_load_public: invalid format in SSH

Check what format your key file is in. The first line should indicate the format:

head -1 ~/.ssh/id_rsa.pub

Expected formats:
- OpenSSH public key: ssh-rsa AAAAB3NzaC1yc2E...
- OpenSSH private key: -----BEGIN OPENSSH PRIVATE KEY-----
- Old PEM private key: -----BEGIN RSA PRIVATE KEY-----

If you see something else like ---- BEGIN SSH2 PUBLIC KEY ---- (PuTTY format), the key needs to be converted or regenerated.

If you have the private key but the public key is corrupted or missing, regenerate it:

ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub

This extracts the public key from your private key in the correct OpenSSH format. The new public key file will have the correct format starting with ssh-rsa.

If the key was edited on Windows or copied through certain tools, it might have a UTF-8 BOM (invisible byte sequence at the start). Remove it:

sed -i 's/^//g' ~/.ssh/id_rsa
sed -i 's/^//g' ~/.ssh/id_rsa.pub

This removes any BOM characters from the beginning of the file. After this, test if SSH works.

If you transferred the key from Windows, it may have CRLF (\r\n) line endings instead of LF (\n). Convert them:

# On Linux/Mac using dos2unix
dos2unix ~/.ssh/id_rsa
dos2unix ~/.ssh/id_rsa.pub

# Alternative using sed
sed -i 's/\r$//' ~/.ssh/id_rsa
sed -i 's/\r$//' ~/.ssh/id_rsa.pub

Verify the line endings:

file ~/.ssh/id_rsa

Should show "ASCII text" or "OpenSSH private key". If it shows "CRLF", they weren't converted properly.

If the key is in PuTTY format (.ppk), you need PuTTYgen or ssh-keygen to convert it.

Using PuTTYgen (on Windows):
1. Open PuTTYgen
2. Click File → Load Private Key
3. Select your .ppk file
4. Click Conversions → Export OpenSSH key
5. Save as id_rsa (without .ppk extension)

Using ssh-keygen (on Linux/Mac/WSL):

First, check if PuTTYgen is available or use ssh-keygen directly (may not work for PuTTY format):

ssh-keygen -i -f id_rsa.ppk -m pem -p -N ""

Or use puttygen if installed:

puttygen id_rsa.ppk -O private-openssh -o id_rsa

If your private key shows -----BEGIN RSA PRIVATE KEY----- but you're getting invalid format errors, it might be old PEM format. Some newer OpenSSH versions prefer the new OpenSSH format. Convert it:

ssh-keygen -p -m RFC4716 -f ~/.ssh/id_rsa

Or regenerate using the PEM format explicitly:

ssh-keygen -t rsa -b 4096 -m pem -f ~/.ssh/id_rsa -N ""

The -m pem flag ensures the old PEM format is used. Alternatively, convert to new OpenSSH format:

ssh-keygen -p -N "" -m openssl -f ~/.ssh/id_rsa

SSH requires strict permissions on key files. Even if the format is correct, wrong permissions can cause issues:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Verify:

ls -la ~/.ssh/

The private key should show -rw------- (600) and public key -rw-r--r-- (644).

After fixing the format, test if the key loads correctly:

ssh-keygen -l -f ~/.ssh/id_rsa.pub

This displays the key fingerprint, which confirms it's in valid format. If it still fails with "invalid format", the file may be truncated or corrupted. Regenerate the entire key pair:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""

Or for RSA (4096-bit):

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

Then add the public key to your servers' authorized_keys file and test the connection.