Calculate the fingerprint of an SSH public key in MD5 and SHA-256 formats for verification.
The fingerprint is a short digest of a public key that two people can compare over a separate channel to confirm they hold the same key. Paste an SSH public key and this tool returns both fingerprints you will meet in the wild: the legacy MD5 form as colon-separated hex and the modern SHA-256 form as a SHA256: base64 string, the same value ssh-keygen -lf prints. The one thing that trips people up: the digest is computed over the decoded binary key data, not over the base64 text, so hashing the pasted characters yourself gives a different number.
SSH public keys are stored in a wire format: a length-prefixed algorithm name such as ssh-ed25519 or ssh-rsa, then length-prefixed fields holding the key material, the modulus and exponent for RSA, the curve name and point for ECDSA, a 32-byte value for Ed25519. The tool base64-decodes the pasted key and hashes that binary blob, so the same key yields the same fingerprints from any file that holds it.
The MD5 fingerprint is 16 bytes written as colon-separated hex, the default ssh-keygen output before OpenSSH 6.8 and still available with -E md5. The SHA-256 fingerprint is a base64 digest shown with the SHA256: prefix, the default since 6.8. Both are digests of the same blob, so they always agree on whether two keys match, and neither contains any recoverable part of the key.
Most likely a format or key mismatch. ssh-keygen -lf prints the SHA256: form by default; add -E md5 for the colon-separated hex. Confirm you pasted the same key file you fingerprinted locally, and that both sides show the same key type, since a host often has several keys with different fingerprints.
Yes. The fingerprint is a one-way digest of a public key that is already public; publishing it reveals nothing about the private key and cannot be reversed into key material. That is exactly what server operators do when they publish host key fingerprints, and what makes out-of-band comparison a useful check.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.