SSH Key Fingerprint Calculator

The first time you connect to an SSH server, your client shows a message like “The authenticity of host can’t be established” and a fingerprint. That string is how you check that you are talking to the right machine rather than an impostor. The same kind of fingerprint identifies the public keys you give to GitHub, GitLab or a server’s authorized_keys file. This page computes it for any public key you paste, in the formats OpenSSH and hosting sites use.

What is hashed

A public key line has three fields: the key type, such as ssh-ed25519, a Base64 block, and an optional comment. The Base64 block decodes to a binary structure holding the type name and the key numbers. The fingerprint is a hash of that binary block, so it ignores the comment: two lines with different comments but the same key have the same fingerprint. OpenSSH 6.8 and later print the SHA-256 hash in Base64 without trailing equals signs, prefixed with SHA256:. Older versions and some sites print the MD5 hash as sixteen colon-separated hex pairs.

A worked example

The Sample button loads a throwaway Ed25519 key with the comment gen-ed25519. The page reports type ssh-ed25519, strength 256 bits, SHA-256 fingerprint SHA256:MBGyPifMEVER/AnYY/zI1CPObu/OQ/2YPHcrVXBlSIg and MD5 fingerprint MD5:74:b4:76:d9:4b:81:79:70:01:6d:c9:c5:4a:4b:99:67. It also shows the SHA-1 of the key in the old colon format and a randomart box headed [ED25519 256] with [SHA256] at the foot. The same key given to ssh-keygen -lv prints the same fingerprint and picture, which is how the output was checked.

The randomart picture

Staring at 43 Base64 characters invites mistakes, so OpenSSH also draws a small picture. The algorithm, nicknamed the drunken bishop, starts a marker in the middle of a 17 by 9 grid and moves it diagonally, two bits of the fingerprint at a time. Cells the marker visits more often are drawn with denser characters. Two different keys almost always make visibly different pictures, so a quick comparison can tell you that something changed, even if you do not check every character.

Checking before you trust

When you set up a new server, the host key fingerprint is shown by the provider or can be read on the machine with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. Compare that to the one in your first connection prompt. For keys you add to a hosting site, compare the fingerprint of the file you uploaded with the one listed in the settings. In authorized_keys files with many entries, paste the whole file to see which line is which.

Limits

A fingerprint identifies a key, not a person, and it says nothing about whether the key is strong or trusted. The page does not look up servers, check revocation or read private keys; never paste one.

Habits that avoid trouble

Write down the fingerprint of every key you create, together with its purpose and where it was installed, so that you can remove it later. When a server’s key changes, treat the warning from your SSH client as real until you have compared the new fingerprint through a second channel, such as the hosting provider’s console. In teams, keep the list of authorised keys under version control and check new entries with this page before merging. Rotate keys when people leave, and prefer one key per device so that a lost laptop affects only one entry.

Related tools

• RSA and Ed25519 Key Pair Generator makes the keys whose fingerprints you can check here.
• SSH Config Generator writes the client file that uses them.
• JWK to PEM Converter converts a key to an OpenSSH public key line.
• ASN.1 Decoder shows the structure of PEM keys.