b2KIT

SSH Key Fingerprint Calculator

Compute MD5 and SHA-256 fingerprints for SSH public keys. Verify server key authenticity visually.

Tested tool guide Tested browser tools Checked August 16, 2026

What SSH Key Fingerprint Calculator does and how it behaves

Paste an SSH public key - a single line such as ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... [email protected] - and the tool returns the two fingerprints OpenSSH itself would print: a colon-separated hex value prefixed MD5: and a base64 value prefixed SHA256:. The common surprise is that a fingerprint hashes the base64-decoded key blob only: the key type word, the comment, and line breaks are ignored, so editing the comment never changes the fingerprint. The second surprise: SHA-256 fingerprints are base64, not hex, so they look nothing like MD5 ones.

How the result is produced

1

Parsing the key line

The tool works on the public key line, isolating the base64 data: for standard single-line keys this is the second whitespace-separated field, after the algorithm word (ssh-rsa, ssh-ed25519) and before the optional comment. It decodes that field to the binary SSH wire blob - a length-prefixed algorithm string plus the key integers, for RSA the exponent and modulus, for ed25519 a 32-byte public value.

2

Hashing and formatting

Hashing the decoded blob yields exactly what ssh-keygen prints: the SHA-256 digest, base64 without padding, prefixed SHA256:, matches the default output of ssh-keygen -lf; the MD5 digest in colon-separated hex pairs, prefixed MD5:, matches ssh-keygen -E md5 -lf. Both hashes cover identical bytes, so they always agree on whether two keys match; they differ only in how hard forging a collision is.

Good uses

  • First connection to a new server: your SSH client prints a host-key fingerprint you have never seen. Compute the fingerprint from the key in the provider's documentation, or from ssh-keyscan output, and accept the connection only when they match.
  • Sort out key drift across machines: when the entries in a server's authorized_keys file no longer match the .pub files on your machines, compute fingerprints of both sides to identify which local key is actually in use, without ever exposing a private key.
  • Confirm that two key files hold the same material: exports of one key pair, even in different formats such as PEM and OpenSSH's default, decode to the same blob and therefore the same fingerprint.

Limits and checks

  • MD5 fingerprints are not collision-safe: researchers have demonstrated practical chosen-prefix collisions for MD5, so a matching MD5 value is weak evidence against a deliberate attacker. Modern OpenSSH defaults to SHA-256 and requires -E md5 for the old form; prefer SHA-256 for anything security-critical.
  • A fingerprint proves key material, not identity. Matching values only show that the key you pasted is the same as your reference; they say nothing about who controls the far end. If the reference fingerprint came from an untrusted source, or an attacker could swap the server's host keys, the match gives no assurance.
  • The tool reads public keys only, and small input errors change everything: pasting a private key or a .ppk file produces no meaningful fingerprint, and wrapping, truncating, or editing the base64 field yields a fingerprint that matches nothing. Identical fingerprints from files that differ only in the comment are expected, not a bug.

Common questions

Why does the fingerprint not match what my SSH client printed?

Check that you hashed the same key ssh verified. Servers commonly hold several host keys (RSA, ECDSA, Ed25519) and ssh picks one by negotiation, so a fingerprint computed from the RSA host key can never match an Ed25519 fingerprint the client displayed. Other causes: the host key was regenerated after a reinstall or container rebuild, or you pasted a user key while the client was verifying the host key.

Can I paste a private key or a PuTTY .ppk file?

No. A fingerprint is defined over public key material, and private-key files (.ppk, PEM, OpenSSH private format) have a different structure, so the result would not equal anything ssh prints. Convert first: ssh-keygen -y -f id_rsa prints the public line this tool reads, and PuTTYgen's public-key field for the OpenSSH authorized_keys format provides the same input.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.