Developer

SSH Public Key Fingerprint

Calculate the SHA-256 fingerprint of an SSH public key in Base64 and hex to verify identity without sharing the full key.

Loading interactive tool…

Embed this tool on your site

About this tool

The SSH Public Key Fingerprint calculator hashes the key blob of an OpenSSH public key line (ssh-rsa, ecdsa-sha2-nistp256/384/521, ssh-ed25519) directly in your browser. Fingerprints are short hashes derived from the key material that identify a key without exposing the full key content. They are used to verify host keys in SSH connections, confirm GitHub/GitLab deploy key identity, and compare keys without transmitting the full key bytes. Click Compute Fingerprints to see three results: SHA-256 in Base64 (the modern format shown by ssh-keygen -l -E sha256), SHA-256 in colon-separated hex, and an MD5 line. Two caveats: the Base64 value ends with an = padding character that ssh-keygen and GitHub leave off, so ignore it when comparing; and the MD5 line is currently computed incorrectly and does not match ssh-keygen -E md5, so do not use it for verification. Your key never leaves your browser.

Why use it

  • Calculates the SHA-256 fingerprint that modern OpenSSH, GitHub and GitLab display.

  • Works with RSA, ECDSA (P-256/P-384/P-521), and Ed25519 public key lines.

  • Your private key is never needed or requested — works with public keys only.

  • 100% browser-based: no key data is sent to any server.

  • Helps spot man-in-the-middle attacks: a fingerprint mismatch is the single most reliable signal you are connecting to a wrong server.

How to use

  1. Paste your SSH public key (the content of id_rsa.pub, id_ed25519.pub, etc.) into the SSH Public Key box. The line must start with the key type, e.g. ssh-ed25519 AAAA… comment.
  2. Click Compute Fingerprints.
  3. Compare the SHA-256 (Base64) value, minus its trailing =, with the value shown on GitHub, GitLab, or by ssh-keygen -lf for your server.
  4. Click Copy next to the SHA-256 (Base64) or SHA-256 (Hex) result to copy it.
  5. Remove any authorized_keys options (such as command="…") and known_hosts hostnames from the start of the line before pasting; the tool reads the second word as the key data.

When it helps

  • Verifying that a public key matches what is registered on GitHub or GitLab.
  • Confirming SSH host key fingerprints before connecting to a new server.
  • Comparing a local public key fingerprint against a trusted reference.
  • Auditing deploy keys or authorized_keys entries by fingerprint, one key line at a time.
  • Onboarding new developers: confirm that the public key they submit hashes to the same fingerprint they showed during a verification call.

Examples

Ed25519 key

Input
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIImEkXeFHoHtZ2AR+CRDDygX8FWH7fCby20SUBK2FpSS user@host
Expected result
SHA-256 (Base64): SHA256:0Rp1ltEAlw0dZUFH+30cnvQAhTVDrWlk8N82AQECZNA=
(ssh-keygen -l -E sha256 shows SHA256:0Rp1ltEAlw0dZUFH+30cnvQAhTVDrWlk8N82AQECZNA)

ECDSA P-256 key

Input
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNIXlw/C9xQOr8Q34JHjpYhI9qL2hQaDDAKfGNsYKYTFwcsENxwO5wtIecQCTXPyNgox0tqWjHZhilabCGkzLdA= user@host
Expected result
SHA-256 (Base64): SHA256:NTvDaEFhgMM+AoBDKowJZpa1dOuof6xrcRwEuX3NJvE=
(ssh-keygen -l -E sha256 shows SHA256:NTvDaEFhgMM+AoBDKowJZpa1dOuof6xrcRwEuX3NJvE)

Key data only

Input
AAAAC3NzaC1lZDI1NTE5AAAAIImEkXeFHoHtZ2AR+CRDDygX8FWH7fCby20SUBK2FpSS
Expected result
Invalid key format — expected "ssh-rsa AAAA… comment"

Tips

  • Always compare SHA-256 fingerprints, not MD5 — MD5 has known collisions, OpenSSH 6.8+ deprecated it as the default, and this tool's MD5 line is not accurate.
  • On macOS and Linux, run `ssh-keygen -l -E sha256 -f ~/.ssh/id_ed25519.pub` to compute the same fingerprint locally; it matches this tool's Base64 value without the trailing =.
  • GitHub displays SHA-256 fingerprints without the SHA256: prefix in some places and with it in others; compare only the Base64 characters.
  • Never publish the contents of id_rsa, id_ed25519, or any file without .pub — the fingerprint is for the public key only, but accidentally pasting a private key into a web form is a credential leak.
  • Host keys live in /etc/ssh on the server. To find your server's fingerprint, run `ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub` directly on the host before exposing it to SSH.
  • If you use multiple SSH keys, label each `.pub` file with a comment (the trailing 'user@host') so fingerprints can be matched back to the right key without recomputing every time.

Frequently Asked Questions

Is it safe to paste my public key here?
Yes. SSH public keys are designed to be shared publicly. This tool only requires the public key (id_rsa.pub), never the private key. No data is sent to any server.
Which fingerprint format does GitHub use?
GitHub uses SHA-256 fingerprints in base64 format (e.g. SHA256:AbCd...). The tool's SHA-256 (Base64) result is that value with an extra = at the end; drop the = when comparing.
Can I use the MD5 result?
No. The MD5 line is computed with a faulty MD5 routine and does not match ssh-keygen -l -E md5 for the same key. Use the SHA-256 result, or run ssh-keygen -l -E md5 -f key.pub locally if a legacy system shows only MD5.
How does the fingerprint help verify a host key?
When you first connect to an SSH server, it shows you its host key fingerprint. Comparing this against a pre-verified fingerprint (from your server provider's dashboard) confirms you are connecting to the correct machine and not a man-in-the-middle.
Does it work with OpenSSH public key format?
Yes. Standard OpenSSH public key lines (starting with ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519 etc.) are supported. The tool hashes the second whitespace-separated field, so lines from known_hosts or authorized_keys entries with options in front must be trimmed first.
Why do RSA and Ed25519 fingerprints look the same length?
Both use SHA-256 internally, so the hash is 256 bits and the base64 output is the same length (43 chars without padding) whatever the key type or size.
Does this tool support PuTTY .ppk files?
No — paste the OpenSSH public key (the line that starts with ssh-rsa, ssh-ed25519, or ecdsa-sha2-...). PuTTY's PPK format must first be converted to OpenSSH using PuTTYgen Export.
Why do I see DEPRECATED messages on MD5 in my SSH client?
OpenSSH switched the default fingerprint hash to SHA-256 in version 6.8 (2015). MD5 still works but is flagged because of its weakness. Use SHA-256 wherever possible.

Explore the category

Hash Generator Generate SHA-256, SHA-1, MD5 hashes File Hash Multi (MD5, SHA-1, SHA-256, SHA-512) Compute MD5, SHA-1, SHA-256, and SHA-512 of any file in your browser PGP Encrypt / Decrypt Encrypt, decrypt, generate PGP key pairs, and sign/verify messages in-browser with OpenPGP.js. Certificate Decoder Decode RSA X.509 certificates from PEM or base64 DER to see subject, issuer, SANs, validity, key size, serial and fingerprints. Page Screenshot Service Capture full-page or viewport screenshots of any public URL as PNG or JPG using real browser rendering. DNS Lookup Tool Query public DNS records with SSRF-safe hostname validation
Public Key Cryptography Explained Simply: Keys, Ciphers, and Signatures The magic behind HTTPS, SSH, and PGP encryption is public key cryptography — a system where you can encrypt a message that only the intended Feb 2026 · 10 min How PGP Encryption Works: Keys, Trust, and Real-World Use PGP (and OpenPGP) has secured email and files since 1991. We explain key pairs, the web of trust, signing vs encrypting, and where PGP still Mar 2026 · 8 min

Glossary

SSH public key
The non-secret half of an SSH keypair, safe to share. Used by servers and services like GitHub to verify the corresponding private key signature.
Fingerprint
A short cryptographic hash of a public key. Lets humans verify key identity without comparing the entire base64-encoded key blob.
SHA-256 fingerprint
Modern fingerprint format in OpenSSH 6.8+. 256 bits of SHA-2 output encoded as base64, prefixed with SHA256: in display.
MD5 fingerprint
Legacy fingerprint format from earlier OpenSSH releases. 128-bit MD5 hash displayed as 16 colon-separated hex pairs. Now considered weak.
RSA key
An SSH key based on the RSA algorithm. Common sizes are 2048 and 4096 bits. Identified by the ssh-rsa prefix in public key files.
Ed25519 key
A modern Edwards-curve digital signature key. Shorter (32 bytes), faster, and considered safer than RSA. Identified by the ssh-ed25519 prefix.
ECDSA key
An SSH key based on Elliptic Curve Digital Signature Algorithm, typically over the NIST curves P-256, P-384, or P-521. Identified by the ecdsa-sha2-nistp prefix.
known_hosts
A client-side file (~/.ssh/known_hosts) listing the host keys SSH has previously seen and trusted, indexed by hostname.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities