BYTETOOLS

SSH Key Fingerprint Generator

Generate the SHA-256 and MD5 fingerprints of an SSH public key, matching ssh-keygen exactly, with the key type and size read from the blob.

…or drop a .pub fileHashed locally — the key is never uploaded

What is the SSH Key Fingerprint Generator?

An SSH key fingerprint is a hash of the raw public-key blob. Modern OpenSSH shows it as SHA256: followed by unpadded Base64; older tools show an MD5 hash as colon-separated hex.

  • SHA-256 fingerprints identical to ssh-keygen -lf, with Base64 padding stripped
  • Legacy MD5 colon-hex fingerprints matching ssh-keygen -E md5
  • Key type and size read from the blob: RSA, Ed25519, ECDSA and DSA
  • Warnings for RSA keys under 2048 bits and for obsolete DSA keys
  • Field-by-field view of the length-prefixed key blob
  • Runs locally with Web Crypto — the key is never uploaded

How to use the SSH Key Fingerprint Generator

  1. 1

    Paste one line from a .pub file or authorized_keys, or drop the .pub file itself.

  2. 2

    Click Compute fingerprints.

  3. 3

    Compare the SHA-256 value against the fingerprint you were given out of band.

  4. 4

    Use the MD5 form if the system you are checking against still displays that format.

  5. 5

    Read the key blob structure table if you want to see how the key is encoded.

About the SSH Key Fingerprint Generator

Paste an SSH public key and this tool reproduces exactly what ssh-keygen -lf prints: the key size, the SHA-256 fingerprint in modern OpenSSH form, the key comment and the key type. It also gives the legacy MD5 colon-hex fingerprint that GitHub, older servers and many network appliances still display.

It works by Base64-decoding the key blob and walking its 4-byte length-prefixed fields, reading the key type from the first field and deriving the size from the RSA modulus or the named curve. The blob structure is shown as a table so you can see how an SSH key is actually laid out — the fingerprint hashes those raw bytes, not the Base64 text and not the comment.

This is what you use to verify a host key against a fingerprint published out of band, or to confirm which key an authorized_keys line actually contains. Hashing happens locally with the Web Crypto API and nothing is uploaded. Only ever paste public keys — the .pub file, never the private one.

Frequently asked questions

How do I find the fingerprint of an SSH key?

Paste the contents of your .pub file above and click Compute fingerprints. You get the same SHA-256 value that ssh-keygen -lf prints locally, plus the older MD5 form, without needing a terminal.

Why does my fingerprint not match what the server showed?

Check you are comparing the same hash algorithm — SHA-256 and MD5 fingerprints of the same key look completely different. Also make sure you copied the whole Base64 blob; a truncated paste produces a valid-looking but wrong fingerprint.

Is the SSH key comment part of the fingerprint?

No. The fingerprint hashes only the binary key blob, so changing the email address or hostname at the end of the line does not change it. That is why the same key added to two accounts with different comments still has one fingerprint.

Should I still use MD5 fingerprints?

Only for compatibility with systems that show nothing else. MD5 is broken for collision resistance, and OpenSSH has defaulted to SHA-256 since version 6.8. When you have the choice, always compare the SHA-256 value.

Which SSH key type should I generate?

Ed25519 is the current default: small, fast and with no parameter choices to get wrong. Generate one with ssh-keygen -t ed25519. Use 3072-bit or larger RSA only when you must talk to something that cannot handle Ed25519.

Related tools