What an unrecognized SSH key actually means
An SSH key listed on a GitHub account is a credential that can authenticate as that account. Seeing one you do not recognize is a reason to investigate, not a conclusion. The key could belong to a device you forgot about, a former team member’s setup, an old laptop, or something you did not authorize. The safe approach is to identify the owner and purpose before you delete anything, because removing a key used by a legitimate workflow will break that workflow.
GitHub treats several things as separate access paths. A personal SSH key, a deploy key attached to a repository, and an authorized OAuth application are different mechanisms with different scopes. Auditing one does not audit the others.
GitHub recommends auditing SSH keys, deploy keys and authorized applications as separate access paths. Source
Before and after checklist
Use this as a working list. The “before” column is about gathering facts; the “after” column is about confirming the result.
| Stage | Check | Why it matters |
|---|---|---|
| Before | List every SSH key shown on the account, with its title and any fingerprint or creation detail visible | You need a full picture before deciding which entry is unknown |
| Before | Match each key to a device or person you can name | An unnamed key is the one to question |
| Before | Ask whether any current workflow depends on the key (builds, deployments, a shared machine) | Deleting a key in active use breaks that workflow |
| Before | Check whether the same access is also granted through deploy keys or authorized applications | These are separate paths and need their own review |
| Before | Decide the disposition: keep, replace, or delete | A key that is out of date may need replacement rather than simple removal |
| After | Confirm the key no longer appears in the account’s SSH key list | The visible list is your first confirmation |
| After | Confirm the affected workflow still works, or that you have a replacement path | Removal should not leave a legitimate process stranded |
| After | Note what you removed and when, without recording the key material itself | A record helps future audits |
Removing an account SSH key
The removal itself happens in account settings. GitHub’s documented path is Settings, then SSH and GPG keys, where you can review account SSH keys and delete ones that are unrecognized or out of date.
In Settings, SSH and GPG keys, review account SSH keys and delete ones that are unrecognized or out of date. Source
Keep the scope narrow. This step removes an account SSH key. It does not remove deploy keys, revoke authorized applications, or change repository contents. If your audit found problems in those areas, handle them as their own tasks.
Legitimate workflows to consider before deleting
Not every unfamiliar key is hostile. Consider these common situations before you act:
- A device you no longer use. An old laptop or work machine may still have a key registered. If you still have the device, you can confirm the match; if not, deletion is usually the right call.
- A shared or team machine. Someone else may have added a key for a legitimate purpose. Confirm with the owner before removing it.
- A deployment or automation setup. If a key is used by a scheduled process, deleting it can stop that process. Identify the dependency first.
- A key you created and forgot. Titles and creation dates often jog memory. If you can match it to your own past setup, you may choose to keep or replace it rather than delete it.
When in doubt, the safer sequence is to identify, then replace with a key you control, then remove the old entry. That keeps a working path in place while you close the unknown one.
What this process does not do
Removing an SSH key is a targeted action, not a full account cleanup. It does not:
- revoke OAuth applications or other authorized integrations;
- remove deploy keys from repositories;
- prove who created the key or why;
- confirm that no other access path exists.
Treat each of those as a separate check. An audit is a set of small, verifiable steps, not a single switch.
Where a username lookup fits, and where it does not
A public username search can help you see what a known handle appears to be associated with across public platforms. That is useful context when you are trying to understand an identity or an online footprint. It is not a way to inspect GitHub account settings, and it cannot tell you who owns an SSH key. TraceSeek, the app covered by TruthsSeek, checks known public usernames across 3,000+ platforms and returns a first scan in 20-30 seconds, with the first scan free. It does not operate GitHub settings, and a public match is a lead, not proof of ownership.
Handling credentials safely
Never publish a private key, token, or full credential in a chat, issue, screenshot, or forum post. If you need help identifying a key, share only non-secret details such as its title or the visible fingerprint, and only with someone you trust. If you suspect a key was exposed, removing it from the account is one step; rotating anything that depended on it is a separate decision you should make deliberately.