← All Tools
Key Fingerprint Generator Formatter🔒 100% local
SSH key SHA-256 fingerprints. Privacy-first, no server uploads, no tracking.
Paste an SSH public key line and it base64-decodes the key blob, hashes those bytes with SHA-256 and prints the SHA256: fingerprint that OpenSSH shows. Alongside the fingerprint you get the hex digest, the key type taken from the line and from the blob itself, the bit size, the blob length, the comment, and the ASCII randomart picture. Only public key material is read.
How to use it
- Paste the full public key line from a .pub file, for example ssh-ed25519 AAAAC3Nza... you@host.
- Press Process to hash the decoded blob.
- Compare the SHA256: line with the output of ssh-keygen -lf on the same file, or with the fingerprint your server printed when you first connected.
Worked example
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIX62yw2sICmCVIkpHA2SBY7DeQuf9pyMGooq3mMkDgP [email protected]becomesSHA256:vADa5E4WOB8-JDW9sKDJ2H6FgNHRxu-7OIzNxGcqEVo [email protected] (SSH-ED25519)
========================================================================
Key type: ssh-ed25519
Bit size: 256 bits
Blob bytes: 51
Comment: [email protected]
SHA256 fingerprint:
SHA256:vADa5E4WOB8-JDW9sKDJ2H6FgNHRxu-7OIzNxGcqEVo
Hex SHA-256 of blob:
BC:00:DA:E4:4E:16:38:1F:3E:24:35:BD:B0:A0:C9:D8:7E:85:80:D1:D1:C6:EF:BB:38:8C:CD:C4:67:2A:11:5A
OpenSSH randomart:
+-----------------+
|.+.+o. |
|. +o=.. |
|o+++*= . |
|+.E@o++. |
| +.oOo. S |
|. o++.+. . |
| O.+ .. |
| o *.. |
| ..... |
+-----------------+
Verify locally:
ssh-keygen -lf ~/.ssh/id_ed25519.pub (produces the SHA256: line)
ssh-keygen -lvf ~/.ssh/id_ed25519.pub (also prints the randomart)
The fingerprint is the SHA-256 of the base64-decoded key blob - no secret material is ever used.The fingerprint is the SHA-256 of the 51-byte decoded blob, so it matches ssh-keygen -lf exactly; the randomart picture matches ssh-keygen -lvf.
When to use it
- Checking that the key a colleague sent is the one you are about to authorize, by comparing fingerprints over a channel the key itself did not travel through.
- Working out why two entries with the same comment are being treated as separate keys - the fingerprint is what actually distinguishes them.
- Verifying a host key fingerprint against the value recorded in your team's documentation before adding it to known_hosts.
What it does not do
- This tool reads public keys. Running a private key file through it hashes a different blob entirely and the result will not match the fingerprint of the matching public half.
- SHA-256 is the only digest offered, so the older MD5:aa:bb:... form that some older servers and wiki pages still quote cannot be reproduced here.
- The declared type on the line and the type embedded in the blob are both shown, but the two are not compared, and nothing checks that the key material is well formed beyond reading its first length-prefixed string.
- A fingerprint identifies a key, nothing more. It does not say whether the key is authorized anywhere, when it was created, or whether the algorithm is one your server still accepts.