install

Additional install commands

macOS

Homebrewverified · 100%

brew install badkeys

local Homebrew formula metadata

Linux

Nixverified · 92%

nix profile install nixpkgs#badkeys

nixpkgs package indexes · pkgs/by-name/ba/badkeys/package.nix · source: api.github.com

overview

Package summary

Tool to find common vulnerabilities in cryptographic public keys

Project links

Commands and aliases

badkeys

history

Project history and usage

badkeys is a Python tool and library for checking cryptographic public keys against known vulnerability patterns and blocklist data. It sits in the practical security-tooling niche between certificate/key parsers and vulnerability scanners.

Project history

The badkeys GitHub repository was created in January 2022. Its README says the tool checks public keys in multiple formats for known vulnerabilities, with a public web version at badkeys.info.

The README credits Hanno Boeck as author, says the work was initially funded in 2022 through the CIDI project and CISAT at the IT University of Copenhagen, and notes later 2025/2026 support from NLnet's NGI0 Core Fund.

Adoption history

The project is distributed through PyPI and appears in Homebrew and Nix in the batch package metadata. The README also points users to Repology for distribution packages, suggesting upstream expected operating-system packaging beyond Python-only installation.

Release names show the project expanding its checks over time, including DKIM support in 2024, parser robustness and return-code improvements in 2026, and a 'Post-Quantum Edition' release in June 2026.

How it is used

badkeys users first download blocklist data with badkeys --update-bl, then scan key, certificate, CSR, SSH public key, TLS host, or SSH host material. The README documents return codes that distinguish application errors, parser problems, and vulnerable keys.

Its command-line use is intentionally automation-friendly: quiet output when no vulnerable keys are found, an all-keys output flag for audits, and bitmask return codes for CI or batch scans.

Why package nerds care

badkeys is package-nerd relevant because it turns a pile of cryptographic failure cases into a reusable CLI and library with data updates. Packaging it gives security teams a repeatable way to scan public keys without copying ad hoc scripts around.

It also illustrates a modern security package pattern: a small Python CLI, external vulnerability/blocklist data, optional network scanning modes, and package-manager availability for workstation and CI installation.

Timeline

2022: Public GitHub repository created and initial CIDI/CISAT funding period described by upstream.
2024: v0.0.7 and v0.0.9 releases published; v0.0.9 added DKIM support.
2025: Upstream README notes NLnet NGI0 Core Fund support across 2025/2026.
2026: v0.0.19 'Post-Quantum Edition' released.

Related projects

badkeys is adjacent to OpenSSL, SSH host-key audit tooling, TLS scanners, DKIM key checking, and certificate linting tools.
The README notes Paramiko as an optional dependency for SSH scanning.

Sources

https://badkeys.info/
https://github.com/badkeys/badkeys
https://github.com/badkeys/badkeys/releases
https://pypi.org/project/badkeys/
source_facts.package-manager

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for badkeys. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Installs with 5 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`badkeys`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version0.0.19

manager updated2026-06-17

local dataok

upstreamnot checked

latest detectednot detected

https://badkeys.info

infoRelease/tag comparison is only available for GitHub repositories.https://badkeys.infonone confidence

install metadata

Package metadata

Package key	brew:badkeys
Version	0.0.19
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/badkeys
Homepage	https://badkeys.info
Repository	https://github.com/badkeys/badkeys
Upstream docs	https://badkeys.info/
License	MIT
Source archive	https://files.pythonhosted.org/packages/bd/a7/b222a5f0db2bc9e765252a109da1ab1baeed0da6e0b050e2baa3208650c4/badkeys-0.0.19.tar.gz
Last updated	2026-06-17T09:59:35Z
Pulse	updated
Dependencies	cryptography, gmp, libmpc, mpfr, python@3.14
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	badkeys
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

badkeys

nix profile install nixpkgs#badkeys

normalized package name match
Matched by: Badkeys

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ba/badkeys/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/badkeys.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install badkeys with Homebrew, Nix