SSH Key Fingerprint Generator — SHA256 & MD5

Guide

About SSH Key Fingerprint

Paste an OpenSSH public key (the <code>ssh-rsa AAAAB3...</code> form or <code>ssh-ed25519</code> equivalent) — get SHA-256 (modern) and MD5 (legacy) fingerprints. Plus key type and bit size. Useful when verifying a known_hosts entry, auditing authorized_keys, or comparing a key shared by a coworker.

Why SSH fingerprints exist

Public-key authentication needs a way to recognize “is this the same key I trusted before”. The full key is hundreds of bytes; comparing visually is impractical. The fingerprint — a hash of the key’s binary form — is short enough to verify on a phone screen and unique enough to detect tampering.

When you ssh server.example.com for the first time, the client shows the server’s fingerprint and asks if you trust it. If the fingerprint matches what the admin published, you accept. From then on, your known_hosts file remembers — any future fingerprint mismatch is loud and probably an attack.

Modern format

SHA256:5jDMXz8C2kE0HnrM2J4HhG8OqfH7hPvr2tN1bLwRY7M

OpenSSH 6.8+ shows fingerprints as Base64-encoded SHA-256, prefixed with SHA256:. The legacy MD5 form (32 hex chars in : groups) still appears in older tools and AWS console for some product lines.

How to get an SSH key fingerprint

The canonical command works on Linux, macOS, and Windows (PowerShell or Git Bash):

ssh-keygen -lf ~/.ssh/id_ed25519.pub      # SHA-256 (modern)
ssh-keygen -lf ~/.ssh/id_ed25519.pub -E md5   # legacy MD5 form

To fingerprint a remote host’s key without connecting interactively:

ssh-keyscan github.com | ssh-keygen -lf -

Both print bits SHA256:… comment (TYPE). Or skip the shell entirely — paste the public key above and get the SHA-256 and MD5 fingerprints plus key type and bit size instantly.

Common workflows

Verify a host before adding to known_hosts. Get the expected fingerprint from your provider’s docs (AWS, GitHub, GitLab publish theirs). Compare on first connect.

Audit authorized_keys. Each line is a key. Drop them through this tool, get fingerprints, match against the list of “supposed-to-have-access” fingerprints.

Match a key from a teammate. Coworker sends their public key. Paste here, send them the fingerprint. If it matches what they expect, the share survived intact.

Detect a swapped server key. Server fingerprint changed unexpectedly? Investigate — could be a legitimate rebuild, could be an MITM. Compare against the published value.

Local computation matters

A leaked private key is bad; a leaked public key is fine. But fingerprinting tools that run remotely have access to logs and analytics that can correlate which fingerprint belongs to which connecting IP. Browser-side keeps the metadata local.

Frequently asked questions

SHA-256 or MD5?

SHA-256 has been the OpenSSH default since 6.8 (2015). MD5 is shown for legacy. If you compare against modern tools, use SHA-256.

Why does my fingerprint differ from <code>ssh-keygen -lf</code>?

Almost always whitespace — a trailing space or comment may have slipped into your paste. Trim and retry. The fingerprint is a hash of the binary key data, not the comment.

What is the bit size for ed25519?

Ed25519 is fixed at 256-bit (the curve, not the key form). The "bit size" header is mostly meaningful for RSA / DSA / ECDSA. For ed25519, the security level is comparable to RSA-3000.

Is the key sent anywhere?

No. Parsing and hashing run in your browser. The key never leaves the page.

How do I verify a server fingerprint?

Get the server's fingerprint from a trusted out-of-band channel (admin, dashboard). Connect once and compare against the known_hosts entry your client offers. Match → safe to accept.

How do I get an SSH key fingerprint (Windows, Mac, Linux)?

Run ssh-keygen -lf ~/.ssh/id_ed25519.pub on any platform with OpenSSH installed — it prints the bit size, SHA-256 fingerprint, and comment. Add -E md5 for the legacy MD5 form. On Windows this works in PowerShell or Git Bash. Or paste the public key here to get the same fingerprint with no command line.

What is an SSH key fingerprint?

A short hash of the key's binary form — a SHA-256 (or legacy MD5) digest — used to recognise a key without comparing hundreds of bytes. It lets you confirm a host or user key is the one you expect and detect any tampering, since a single changed byte produces a totally different fingerprint.

What is GitHub's SSH host key fingerprint (ed25519)?

GitHub publishes them so you can verify on first connect. The Ed25519 host key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU, and RSA is SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s. Always cross-check against GitHub's official docs, since host keys can rotate.

Related tools

Last updated: 2026-07-04