SSH & Keys

SSH Key Fingerprint

MD5 / SHA-256

Inspect a public key

Paste the contents of an id_rsa.pub, id_ed25519.pub, or authorized_keys line. Public keys are safe to share — never paste a private key here.
Input Method
Public Key
Paste the contents of an id_rsa.pub, id_ed25519.pub, or authorized_keys line.
Preferred Fingerprint

Tool features

Calculate SSH key fingerprints with advanced verification
4 features

Three hash algorithms

SHA256, SHA512 and MD5 computed together, so you can match whichever format the other side shows.

Format validation

Confirms the key parses as a valid OpenSSH public key before hashing it.

Key metadata

Reports the algorithm and bit length alongside the fingerprints.

Paste or upload

Accepts a pasted authorized_keys line or an uploaded .pub file.

What is an SSH key fingerprint & how it works

How a short hash stands in for a whole key

An SSH key fingerprint is a short hash of a key's public half. Comparing two full keys by eye is impractical — a fingerprint compresses several hundred characters into one fixed-length string you can check at a glance. OpenSSH prints one the first time you connect to an unknown host, and Git providers publish theirs so you can confirm you are talking to the real server rather than something in the middle.

Paste a public key or upload a key file and this tool reports the SHA256, SHA512 and MD5 fingerprints side by side, along with the key's algorithm and bit length. SHA256 is what modern OpenSSH shows by default — base64, printed with a SHA256: prefix. MD5 is the older colon-separated hex form that some appliances and older tooling still display.

Fingerprint
A fixed-length hash that identifies a key without having to move or compare the whole thing.
SHA256
The modern default, shown as SHA256:abc123…. Match this against what your Git host or server publishes.
MD5
Legacy hex form, e.g. 2f:d5:9a:…. Fine for display, but MD5 is broken for collision resistance — do not rely on it alone.
known_hosts
The client-side file where SSH records a server's key after you accept its fingerprint once.

How to use this tool

Fingerprint and verify a public key in four steps
1
Choose an input method
Switch between Paste Key and Upload File at the top of the card, depending on whether you have the key on your clipboard or as a file.
2
Provide the public key
Paste a single .pub line — ssh-ed25519 AAAAC3… user@host — or upload an id_ed25519.pub / id_rsa.pub file. Use the public half only; a private key is never needed to compute a fingerprint.
3
Pick a preferred fingerprint
Select MD5, SHA256 or SHA512. This only sets which one is highlighted first — all three are computed and shown.
4
Compare against the source
Copy the fingerprint and compare it with what the other side reports — ssh-keygen -lf key.pub locally, your Git host's SSH settings page, or the fingerprint SSH printed when you first connected.

Related tools

Keep debugging with tools from the same suite
3 tools
SSH Key Validator
Validate SSH key format, structure, security, and verify public/private key matching
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication
Hash Code Generator
Generate hash codes and checksums for data integrity verification

Frequently asked questions

Common questions about SSH key fingerprints
7 Q&A

It identifies a key without moving the whole key around. Two places use it constantly: verifying a server is who it claims to be the first time you connect (SSH shows the host key fingerprint and asks you to accept it), and confirming that the key you uploaded to a Git host or server is the same one sitting on your laptop.

SHA256, unless the other side only offers MD5. Modern OpenSSH prints SHA256 by default in base64 form with a SHA256: prefix. If a legacy appliance shows you colon-separated hex, that is MD5 — you can produce the same form locally with ssh-keygen -E md5 -lf key.pub.

No. A fingerprint is derived from the public half only, which is why it is safe to publish. If you have only a private key and need its fingerprint, derive the public key first with ssh-keygen -y -f id_ed25519 > id_ed25519.pub, or use our SSH Public Key Extractor.

For a public key, yes — a .pub file is designed to be handed out, and it is what you paste into GitHub or an authorized_keys file. Note that the key is sent to our server to be hashed, then discarded; it is not stored. Never paste a private key into this tool — it does not need one, and a private key should not leave your machine.

Almost always because you are comparing different hash algorithms — an MD5 fingerprint and a SHA256 fingerprint of the same key look nothing alike. Check that both sides are showing the same algorithm. If they are, and the strings still differ, you genuinely have two different keys.

No. The fingerprint is computed over the key material itself, not the trailing comment (user@host) or the name of the file. You can rename a key or edit its comment freely and the fingerprint stays the same.

If SSH warns that a host key has changed, the server is presenting a different key than the one recorded in your ~/.ssh/known_hosts. That can be innocent — the server was rebuilt or migrated — or it can be an interception attempt. Verify the new fingerprint through a channel you trust before removing the old entry with ssh-keygen -R hostname.