Get the SHA256 and MD5 fingerprint of an SSH public key, as ssh-keygen -l shows it
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.An SSH key fingerprint is a short hash that identifies a public key. Paste one or more public keys and get the type, size, SHA256 and MD5 fingerprints and the randomart picture, exactly as ssh-keygen -l prints them. All 28 test keys match ssh-keygen's own output, and private keys are refused.
Paste the public key, the line from id_ed25519.pub, authorized_keys or known_hosts, or press Try an example.
Each key is listed with its type, size, comment and SHA256 fingerprint, the form GitHub and ssh show.
Switch to MD5 for older systems, or open the picture to see the randomart.
Press Copy next to a fingerprint, or convert the key to the RFC 4716 format.
A fingerprint is how people compare SSH keys without reading hundreds of Base64 characters. GitHub's SSH keys page, the "authenticity of host can't be established" prompt and server logs all show one. This page computes it from the key you paste, so you can match a key in authorized_keys to a person, or check a host key before trusting it.
What you get for each key.
| Field | Example |
|---|---|
| Type and size | ED25519 256, RSA 3072, ECDSA 521 |
| SHA256 fingerprint | SHA256: then 43 Base64 characters, the default since OpenSSH 6.8 |
| MD5 fingerprint | MD5: then 16 hex pairs, still shown by some older tools and clouds |
| Randomart | The 17 by 9 picture ssh-keygen -lv draws |
| Comment, options, hosts | From the .pub, authorized_keys or known_hosts line |
What it reads. One key per line from id_ed25519.pub or id_rsa.pub, whole authorized_keys files including options such as from="10.0.0.0/8" or command="...", known_hosts lines with their host names, and RFC 4716 blocks starting ---- BEGIN SSH2 PUBLIC KEY ----, as PuTTYgen saves them. RSA, DSA, ECDSA (P-256, P-384, P-521), Ed25519 and the security-key types ECDSA-SK and Ed25519-SK are understood.
Warnings that matter. A DSA key is flagged, because OpenSSH disabled DSA by default in 7.0 and removed it in 10.0. An RSA key under 2048 bits is flagged too; ssh-keygen now makes 3072-bit RSA keys by default. Paste a private key by mistake and the page refuses it and tells you how to get the public half.
How it was checked. Twenty-eight throwaway keys of every common type were made with ssh-keygen, and for each one the summary line, both fingerprints, both randomart pictures and the RFC 4716 form here are identical to what ssh-keygen printed. Nothing you paste leaves your browser.
On the command line, ssh-keygen -lf ~/.ssh/id_ed25519.pub prints it. Here, paste the contents of the .pub file and the same line appears: the size, the SHA256 fingerprint, the comment and the type. Use the public key only; the private key is never needed for a fingerprint.
Both identify the same key. SHA256 fingerprints, written as SHA256: and 43 Base64 characters, have been the OpenSSH default since version 6.8 in 2015. MD5 fingerprints, written as 16 hex pairs separated by colons, are older but still shown by some cloud consoles and older servers.
Paste the whole authorized_keys file. Every key is listed with its line number, options, comment and fingerprint. Ask each person for the fingerprint of their own key, or compare with the fingerprints GitHub or GitLab show on their SSH keys pages, and remove the lines nobody claims.
Randomart is a 17 by 9 character drawing made by walking a fingerprint two bits at a time, the drunken bishop method. People recognise a changed picture faster than a changed hash, which is why ssh can show it with VisualHostKey=yes. The picture here matches ssh-keygen -lv exactly.
Paste the key that starts with ---- BEGIN SSH2 PUBLIC KEY ---- and copy the OpenSSH line shown for it, which starts with ssh-rsa or ssh-ed25519 and can go straight into authorized_keys. The fingerprint stays the same, which proves only the format changed and not the key.
Public keys are designed to be shared, and nothing is sent anyway: the page works out the fingerprints in your browser. A private key is refused with a warning and never processed. Never paste a private key into any website; the matching .pub file is all a fingerprint needs.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about SSH Key Fingerprint and anybody who knows can answer. No account needed.
Same job, other tools: HMAC-SHA256 Generator – Compute an HMAC-SHA256 signature in hex and Base64 · 2FA Code Generator – Get the current two-factor code from a setup key, without a phone · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.