SSH Key Fingerprint (SHA256 and MD5)

How to get an SSH key fingerprint

1. Paste one or more public key lines into SSH keys, or drop a .pub, authorized_keys or known_hosts file.
2. Each key gets a card with type, size or curve, comment, SHA256 and MD5 fingerprints and the exact ssh-keygen -l line.
3. Choose what the Output pane holds: SHA256 fingerprints, MD5 fingerprints, a PEM public key (SPKI or PKCS#1), RFC 4716, or normalized OpenSSH lines.
4. Copy output or Download the result. Copy fingerprint on a card copies just that one value.

Accepted input goes beyond plain .pub lines: authorized_keys options such as from="10.0.0.0/8",command="…", known_hosts lines with host names or hashed |1|… entries, RFC 4716 ---- BEGIN SSH2 PUBLIC KEY ---- blocks, OpenSSH certificates, PEM public keys, and -----BEGIN OPENSSH PRIVATE KEY----- files.

How the fingerprint is calculated

An OpenSSH public key line has three parts: the type, the Base64 key blob and a comment.

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4ZlfvPsoxxd6tpkc1MDAJvZf8exJSDeW7a3xQRKA7d alice@laptop

The fingerprint is a hash of the decoded blob, 51 bytes for Ed25519:

SHA256 fingerprints are written in Base64 with the trailing = removed, which is why they are always 43 characters after the prefix. The same calculation in Python:

import base64, hashlib, sys

line = open(sys.argv[1]).read().split()
blob = base64.b64decode(line[1])
digest = hashlib.sha256(blob).digest()
print("SHA256:" + base64.b64encode(digest).decode().rstrip("="))

See padding explained for why the = can be dropped, and Base64 in Python for more.

Checking a host key before you trust it

The first time you connect, OpenSSH asks: ED25519 key fingerprint is SHA256:…. Are you sure you want to continue connecting? The right answer depends on comparing that value with one obtained another way:

• on the server console: ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
• from your provider’s published host key fingerprints
• from a colleague who already has the host in known_hosts: paste that file here and every entry is listed with its fingerprint

To see what a server offers without logging in, ssh-keyscan host.example.com | ssh-keygen -lf - prints all its host key fingerprints.

Recognizing key types by their Base64

The blob begins with the key type as a length-prefixed string, so each type has a fixed Base64 opening:

If the type word on the line and the blob disagree, the card warns about the mismatch. That usually means a line was edited by hand.

Warnings and limits

• RSA under 2048 bits is flagged as weak, and DSA keys are flagged because modern OpenSSH disables them.
• Certificates (*-cert-v01@openssh.com) show key ID, serial, user or host type, principals, validity, critical options, extensions and the fingerprint of the signing CA key.
• FIDO keys (sk-…) and Ed448 decode, but have no PEM conversion.
• The comment stored inside a private key file is not shown.
• SHA256 uses the browser’s WebCrypto API, which needs an https page. MD5 is computed by the page itself.

FAQ