SSH Key Fingerprint Calculator
Paste the one-line public key from a .pub file or an authorised keys list to see its fingerprints, key type and size.
Only paste the public key, the line that starts with a key type such as ssh-ed25519. Never paste a secret key file into any web page.
Worked examples
An Ed25519 key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7iTI1z/W3VWuScu3HnhDo5oc/uP2W9AFAoM4ei+28A me@laptop
SHA256:OyOHuTqe1JzYeaAgJI1S8aBLBd+3O8AsunxugPaKId0, 256 bits
The same value is shown by the standard command line tool for this key.
About SSH Key Fingerprint Calculator
A fingerprint is a short code worked out from a key. You are shown one when you connect to a server for the first time, when you add a key to a code hosting account, and in audit tools. Comparing it with the value you expect is how you make sure you are trusting the right key and not one swapped in by an attacker. The fingerprint depends only on the key itself, so two keys with the same fingerprint are the same key whatever their comments say.
Paste the one-line public key, the contents of a file ending in .pub or a line from an authorised keys list, and the tool works out the SHA-256 fingerprint in the form current software shows, starting with SHA256:, and the older MD5 form written as pairs separated by colons. It also reads the key type and size from the key data, so you can see at once whether an RSA key is 2048 bits or longer and whether a key is an elliptic curve or Ed25519 key. Options at the start of a line are handled and the comment is shown.
How to use SSH Key Fingerprint Calculator
- Open the public key file, the one ending in .pub, and copy the whole line.
- Paste it into the box.
- Read the key type, size and fingerprints.
- Compare the fingerprint with the one shown by the server or service, character by character.
Common uses
- Checking a key before adding it to a server's authorised keys
- Matching a key to the fingerprint shown by a hosting service
- Auditing a list of authorised keys for weak or old keys
- Working out which key a fingerprint in a log belongs to
Frequently asked questions
Which file do I paste?
The public key, which ends in .pub, for example id_ed25519.pub. It is one line starting with the key type. Never paste the other file, the secret key, into any web page.
Why are there two fingerprints?
Older software showed fingerprints worked out with MD5, written as pairs of characters separated by colons. Current software uses SHA-256, written in Base64 with SHA256: in front. Both identify the same key. Use whichever form the other system shows.
Does changing the comment change the fingerprint?
No. The comment, usually an email address or machine name, is not part of the key. Only the key data is used.
Which key type should I use?
Ed25519 is a good default for new keys. It is short, fast and strong. RSA keys should be at least 2048 bits, and 3072 or 4096 is better. DSA keys are obsolete.
How careful should I be comparing fingerprints?
Compare the whole value. Attackers can make a key whose fingerprint starts the same way as a real one, so checking only the first few characters is not enough.