What is an SSH key fingerprint?
An SSH key fingerprint is a short hash computed over a public key's raw binary data. A typical public key is several hundred characters of base64 — impractical to compare by eye. The fingerprint compresses it into one fixed-length string: 47 characters for MD5 (b2:20:ad:95:...) or 43 for SHA256 (SHA256:tYg+Avx+...).
Two places use fingerprints constantly: verifying a server's identity (SSH prints the host key fingerprint the first time you connect and asks you to confirm it) and confirming your own key (checking the key you uploaded to GitHub or a server matches the one on your laptop). If two fingerprints match, the underlying keys are byte-identical.
Get your fingerprint on Linux, macOS & Windows
Linux / macOS — SHA256 (the modern default):
ssh-keygen -lf ~/.ssh/id_ed25519.pub
For the legacy MD5 colon-hex format:
ssh-keygen -E md5 -lf ~/.ssh/id_rsa.pub
Windows — with Git for Windows or OpenSSH installed, open PowerShell and run:
ssh-keygen -lf $env:USERPROFILE\.ssh\id_ed25519.pub
No terminal handy? Paste the .pub contents into the checker above — it produces character-for-character the same output as ssh-keygen -lf, verified against real OpenSSH.
MD5 vs SHA256 fingerprints
OpenSSH historically displayed MD5 fingerprints as colon-separated hex (MD5:b2:20:ad:95:a5:1f:45:9a:...). Since OpenSSH 6.8 the default is SHA256, shown as unpadded base64 with a SHA256: prefix. Both are hashes of the same key blob — the comment (user@host) and filename never affect the fingerprint.
Rule of thumb: compare SHA256 whenever both sides offer it. MD5 is fine for eyeball comparison against legacy systems, but it is cryptographically broken — never let an MD5 match be your only trust signal. The #1 cause of "fingerprint does not match" confusion is comparing an MD5 string against a SHA256 string; they will never look alike even for the same key.
What is SSH randomart?
Randomart is an ASCII-art rendering of a key's fingerprint, generated by the drunken bishop algorithm: a deterministic random walk across a 17×9 grid, driven by the fingerprint bytes. S marks where the walk starts, E where it ends. Run ssh-keygen -lv -f key.pub to see yours.
Its purpose is human pattern recognition — most people remember a shape faster than 43 base64 characters. When you connect to a server for the first time, glancing at the randomart and confirming "yes, that's the shape I saw in the docs" is a legitimate extra check on top of comparing the string. This tool's randomart is bit-identical to OpenSSH's, validated against real ssh-keygen output across RSA, ECDSA and Ed25519 keys.
"SSH key fingerprint does not match" — what to do
If a fingerprint doesn't match your reference, stop and investigate — don't just accept the new key. Work through this list:
- Same algorithm? An MD5 fingerprint and a SHA256 fingerprint of the same key look completely different. Normalize both sides first.
- Right key type? Providers publish several host keys (RSA, ECDSA, Ed25519). Make sure you're comparing the same type SSH offered you.
- Legitimate rotation? Host keys change when servers are rebuilt or migrated. Check the provider's status page or docs for rotation announcements.
- Wrong server? Typos in hostnames and stale DNS can land you on an unexpected machine.
- Man-in-the-middle? If none of the above explains it, treat it as a possible interception. Verify the key through an independent trusted channel (server console, your hosting dashboard, a colleague) before proceeding.
If SSH warns WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED, remove the stale entry with ssh-keygen -R hostname only after you've confirmed the new fingerprint through a trusted channel.
Verify GitHub, GitLab & Bitbucket host keys
Git hosting providers publish their SSH host-key fingerprints so you can confirm you're talking to the real server on first connect. Use the Verify Host Key tab above — or compare manually against this reference (verified 2026-10-06):
| Provider | Type | SHA256 |
|---|---|---|
| GitHub github.com | RSA | SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s |
| ECDSA | SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM | |
| Ed25519 | SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU | |
| GitLab gitlab.com | RSA | SHA256:ROQFvPThGrW4RuWLoL9tq9I9zJ42fK4XywyRtbOz/EQ |
| ECDSA | SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw | |
| Ed25519 | SHA256:eUXGGm1YGsMAS7vkcx6JOJdOGHPem5gQp4taiCfCLB8 | |
| Bitbucket bitbucket.org | RSA | SHA256:46OSHA1Rmj8E8ERTC6xkNcmGOw9oFxYr0WF6zWW8l1E |
| ECDSA | SHA256:FC73VB6C4OQLSCrjEayhMp9UMxS97caD/Yyi2bhW/J0 | |
| Ed25519 | SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM |
Sources: GitHub docs, GitLab docs, Atlassian support docs (links in the Verify tab). Host keys can be rotated — always cross-check with the provider's official documentation.
How this tool compares
| Feature | This tool | showdns.net | simplified.tools |
|---|---|---|---|
MD5 + SHA256 in exact ssh-keygen format | ✅ | ✅ (+SHA512) | ✅ (+SHA-1 opt) |
| Randomart (drunken bishop) | ✅ bit-identical | ❌ | ❌ |
| Built-in reference DB (GitHub/GitLab/Bitbucket) | ✅ one-click verify | ❌ | ❌ |
| Batch compare many keys | ✅ + duplicate detection | ❌ | ❌ |
| Private-key paste warning | ✅ hard block + guidance | ⚠️ text note | ✅ rejected |
| PEM / RFC 4716 / known_hosts input | ✅ | ❌ OpenSSH only | ✅ |
| SSHFP record generator | ✅ | ❌ | ✅ |
| 100% client-side (keys never uploaded) | ✅ | ❌ server-side hashing | ✅ |
| Free, no signup | ✅ | ✅ | ✅ |
Feature comparison based on the publicly visible feature sets of showdns.net/ssh-key-fingerprint and simplified.tools/check_ssh_key_fingerprint as of October 2026. If anything changed, let us know.
Frequently asked questions
ssh-keygen -lf ~/.ssh/id_ed25519.pub (or id_rsa.pub) in your terminal. It prints the bit length, the SHA256 fingerprint, your key comment, and the key type — for example: 256 SHA256:abc... user@host (ED25519). Add -E md5 to see the older colon-separated MD5 format instead.ssh-keygen -lf $env:USERPROFILE\.ssh\id_ed25519.pub. Alternatively, paste the contents of your .pub file into the checker above — it computes the exact same fingerprints without needing a terminal.SHA256: prefix. MD5 fingerprints (colon-separated hex) are still shown by some older appliances and Git hosting e-mails; they are fine for visual comparison but MD5 is cryptographically broken, so never rely on it as the sole trust signal.SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU). The Verify tab above checks any fingerprint against GitHub's, GitLab's and Bitbucket's published keys automatically.SHA256:ROQFvPThGrW4RuWLoL9tq9I9zJ42fK4XywyRtbOz/EQ, ECDSA SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw, and Ed25519 SHA256:eUXGGm1YGsMAS7vkcx6JOJdOGHPem5gQp4taiCfCLB8. They are listed in GitLab's official documentation and mirrored in the reference table on this page.SHA256: or MD5: and any colons or spaces, then compare case-insensitively. The Batch tab above does this for many keys at once and flags duplicates automatically.S marks the walk's start and E its end. It lets humans recognize a key by shape instead of memorizing base64. This tool renders randomart byte-identical to ssh-keygen -lv.ssh-keyscan github.com (or any host) to print its public host keys, then ssh-keygen -lf on the output — or paste the scanned key into this tool. Compare the result with the provider's published fingerprints before accepting.ssh-keygen -lf key.pub for SHA256, or ssh-keygen -E md5 -lf key.pub for MD5. In a browser: paste the .pub contents into the checker above. Only the public key is ever needed — deriving a fingerprint never requires the private key.ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub, then fingerprint the .pub file.host.example.com IN SSHFP 4 2 HEXDIGEST). With DNSSEC and VerifyHostKeyDNS enabled, your SSH client can verify host keys automatically instead of asking you. This tool generates the record for any key you analyze.