SSH Key Fingerprint
Compute the fingerprints of OpenSSH public keys exactly as ssh-keygen -l prints them. Paste a line from id_ed25519.pub, authorized_keys or known_hosts, or an RFC 4716 SSH2 public key block, and get the SHA-256 fingerprint in base64, the legacy MD5 fingerprint in colon hex, the key type, its size and comment. RSA, DSA, ECDSA, Ed25519 and FIDO security keys are supported, up to 100 keys at once.
Frequently asked questions
What input does the tool expect?
Paste an OpenSSH public key line such as ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host, one key per line. Lines from authorized_keys with options in front and known_hosts lines with host names in front work too, because the key type is located in the line. Empty lines and lines starting with # are skipped.
How is the SHA-256 fingerprint computed?
The base64 key data is decoded to the binary key blob, hashed with SHA-256 and written as SHA256: followed by base64 without trailing = padding. This is the format ssh-keygen -l, OpenSSH host key prompts and GitHub use.
What is the MD5 fingerprint for?
Older OpenSSH versions before 6.8 and some hosting panels still show the MD5 form, 16 bytes as lowercase hex pairs separated by colons. It is shown with the MD5: prefix, matching ssh-keygen -E md5 -l. Prefer SHA-256 for comparisons.
Which key types are supported?
ssh-rsa, ssh-dss, ssh-ed25519, ecdsa-sha2-nistp256, nistp384 and nistp521, and the FIDO security key types sk-ssh-ed25519@openssh.com and sk-ecdsa-sha2-nistp256@openssh.com. OpenSSH certificates ending in -cert-v01@openssh.com are not supported.
How is the key size determined?
RSA and DSA keys report the bit length of their modulus or prime, ECDSA keys report 256, 384 or 521 according to their curve, and Ed25519 keys report 256. The tool also checks that the type inside the key blob matches the type written in front of it.
Can I paste an RFC 4716 SSH2 public key?
Yes. Blocks between ---- BEGIN SSH2 PUBLIC KEY ---- and ---- END SSH2 PUBLIC KEY ----, as exported by PuTTYgen and some commercial SSH servers, are read with their Comment header. Each block counts as one key.
What does the ssh-keygen line show?
It reproduces the output of ssh-keygen -l -f key.pub: size, SHA-256 fingerprint, comment and type in parentheses, for example 256 SHA256:... user@host (ED25519). A key without a comment shows no comment, as ssh-keygen does.
Can I paste a private key?
No, and you should not. The tool reads public keys only. To get the public key from a private key file on your own machine, run ssh-keygen -y -f ~/.ssh/id_ed25519 and paste its output.
Why is my key reported as invalid?
The base64 data may be cut off, wrapped across lines or mixed with another key, or the type in front may not match the key blob. Copy the whole line from the .pub file again, keeping it on a single line.
Is there a limit and is anything stored?
You can paste up to 100 keys and 262,144 characters at once. Public keys are processed in memory for this request and never logged or saved.