⚠️Security

Public-Key-Pins (HPKP) Header Reader

Parses a Public-Key-Pins header: lists the pins, checks the base64 SHA-256 format, reads max-age and explains why HPKP was dropped and what replaced it.

Public-Key-Pins header

Status

—

HPKP: what that old header used to do

Public-Key-Pins bound a domain to specific public keys: the browser stored the fingerprints and started refusing any certificate that did not match, even one issued by a trusted authority. The idea was sound against a compromised authority. The execution proved too expensive and the mechanism was abandoned.

Paste the header you found in an old configuration and the page reads it: it lists the fingerprints, checks whether each has the shape of a base64 SHA-256, shows the duration in days and flags a missing backup pin, which the specification required. It also warns when the duration is long enough to turn a mistake into a weeks-long incident.

The reason for abandonment was operational, not theoretical. Pinning the wrong key, or losing the pinned key, locks visitors out of the site until the duration expires — and there is no way to undo it remotely, because the browser has already stored the rule. There were cases of sites offline for weeks. Chrome removed support in version 72, in 2018, and Firefox followed. Today the role is filled by Certificate Transparency, a CAA record in DNS and HSTS.

Frequently asked questions

Is it harmful to leave the header in the configuration?

It has no effect on current browsers, which ignore it. But it is worth removing: a dead header in a configuration confuses whoever audits it later and blends in beside directives that still matter. Code with no effect is cheap debt to pay off.

What replaced HPKP?

Three things together. Certificate Transparency, now enforced by default, makes every issued certificate public — which allows detecting improper issuance. A CAA record in DNS limits which authorities may issue for your domain. And HSTS ensures the connection is always HTTPS.

What about Expect-CT?

Also retired, in 2023, and for the opposite reason to HPKP: it stopped being necessary. Certificate Transparency enforcement became the browser default, so a header asking for that check became redundant.

Related Tools

⚠️

Mixed Content Detector

Scans http:// references inside HTML served over HTTPS, flagging insecure assets and links.

🛡️

SSH auth.log Analyzer

Analyzes SSH auth.log files: failures per IP, targeted users, accepted logins, attack peaks and ready-to-copy block lists.

🔒

HSTS Header Builder

Assembles a Strict-Transport-Security header line from a max-age in seconds plus optional includeSubDomains and preload directives, ready to paste into a config.

🔐

Vigenère Autokey Cipher Encoder and Decoder

Enciphers or deciphers text with the classic autokey variant, where the plaintext extends the keyword instead of repeating it. Letters A to Z only.

🐌

Regex ReDoS Risk Analyzer

Analyzes a regular expression and flags ReDoS-prone parts, such as nested quantifiers and ambiguous alternation, without running it.

🕵️

Source Code Secret Scanner

Finds API keys, tokens, passwords and private keys pasted from code or .env files, by known pattern and by high entropy.