A worked example, rendered from real sample data. Sign in to run the tool on your own input.
YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=
SCmeBCKhCo0f51UQ0TJPSx1+MbHhJ5fg7mjnOMfS9XU=═══ HPKP is obsolete — read this first ═══
✗ Chrome removed HPKP enforcement in version 72 (2018) and Firefox followed. No current browser honours Public-Key-Pins.
✗ A wrong pin bricks your domain for the whole max-age with no way to recover — this is why the feature was withdrawn.
ℹ Use Certificate Transparency monitoring (crt.sh, Cert Spotter) to detect mis-issuance instead.
ℹ Use a CAA record to restrict which CAs may issue for your domain.
ℹ For mobile apps, pin in the app (Android Network Security Config, iOS ATS / TrustKit) where you control rollout.
ℹ Keep HSTS with a long max-age and preload — that is the header that still protects you.
═══ Generated header (for legacy systems and audits) ═══
Public-Key-Pins: pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; pin-sha256="SCmeBCKhCo0f51UQ0TJPSx1+MbHhJ5fg7mjnOMfS9XU="; max-age=5184000; includeSubDomains
─── Directives ───
Pins: 2
max-age: 5184000s (60d)
includeSubDomains: yes
Mode: enforcing
report-uri: (none)
─── Pins ───
• YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg= ← pre-computed pin
• SCmeBCKhCo0f51UQ0TJPSx1+MbHhJ5fg7mjnOMfS9XU= ← pre-computed pin
─── Validation ───
✓ 2 pins supplied — keep at least one backup key offline and unused.
⚠ No report-uri — you get no warning before the pin starts blocking real users.
⚠ Enforcing mode. Always deploy Public-Key-Pins-Report-Only first and watch reports for weeks.
─── Modern equivalent ───
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
CAA record: example.com. IN CAA 0 issue "letsencrypt.org"
Generate HTTP Public Key Pinning headers from a certificate. Part of the DevTools Surf developer suite. Browse more tools in the Networking collection.