How to use the ssh key fingerprint calculator
- Open your public key file, which ends in .pub, or copy a line from an authorized_keys file.
- Paste one key per line. Lines that start with # are ignored, and options in front of the key type are skipped.
- Read the type, the size, the SHA256 fingerprint and the MD5 fingerprint of each key.
- Compare the result with what a server or a hosting site shows.
Formula
blob = base64 decode of the second field of the line
SHA256 fingerprint = "SHA256:" + base64 of SHA-256(blob) without trailing = signs
MD5 fingerprint = "MD5:" + the 16 bytes of MD5(blob) as colon separated hex
The key blob starts with the key type as text, which must match the first field. The fingerprints are hashes of the whole blob, so any change to the key gives a different fingerprint.
An Ed25519 key
A key line of the form ssh-ed25519 AAAAC3Nza... ed@host decodes to a blob of 51 bytes. Its SHA256 fingerprint is SHA256:0QpYtWMffKQzUGQ3Hev1OAy2xWGeuZXiSY0oD3XX4Us and its MD5 fingerprint is MD5:88:7e:d9:79:01:29:cf:b3:43:3f:e2:73:4f:97:8a:ad, which is what ssh-keygen -l prints for that key.
The page also reads RSA keys (2048 and 3072 bits in testing), ECDSA keys on the 256, 384 and 521 bit curves and security keys, and gives the bit size of RSA and ECDSA keys.
Why fingerprints exist
A key is a long block of text that is hard to compare by eye. A fingerprint is a short summary that changes completely if the key changes. Servers show one when you first connect, and hosting sites show the fingerprint of keys you have added, so you can check that they match.
The SHA256 form is the default in current OpenSSH. The MD5 form is shown for older tools and sites that still list it.
Public keys only
The page reads public keys. If the text contains a private key, it stops and tells you not to paste it. A private key must never be pasted into a web page. Nothing you type here is sent anywhere, since the hashes are computed in your browser, but that is no reason to share a private key.
The page cannot tell you whether a key is safe to trust. It can only confirm that the key you hold gives the fingerprint you were shown. To hash arbitrary text, use the Hash Generator.
Assumptions and limits
- The key must be in OpenSSH public key format: a type, base64 text and an optional comment.
- The type named in the line must match the type stored inside the key data.
- MD5 is included to compare with older systems and is not recommended for security.
- Up to 50 keys are read at once.
- Nothing you type is stored or sent anywhere.
Frequently asked questions
Why does the SHA256 fingerprint have no equals signs?
OpenSSH prints the base64 of the hash without padding, and this page follows it. A 32 byte hash always needs one equals sign of padding, and OpenSSH leaves it out.
Does the comment change the fingerprint?
No. The comment is not part of the key blob. Two lines with the same key and different comments have the same fingerprint.
Can I use this for a certificate or a host key?
Host keys in the same one line format work. A key inside an X.509 certificate is a different format, so use the certificate decoder for that.
Why is my line rejected?
Most often the second field was cut off while copying, or the type at the start of the line does not match the key data. Copy the whole line from the file again.