Fingerprint Hash Generator

An SSH key fingerprint is a deterministic hash of a public key that serves as a compact, human-readable identifier. Instead of comparing long public key strings (which can be hundreds of characters), users and administrators can verify key identity by comparing short fingerprint strings. SSH key fingerprints are generated by computing a cryptographic hash (MD5 or SHA256) of the raw public key data in its wire-encoded format. The fingerprint is then formatted in a standardized way: MD5 fingerprints use colon-separated hexadecimal pairs (e.g., 2a:3b:4c:...), while SHA256 fingerprints use the format SHA256:xxxx... with URL-safe Base64 encoding.

1. Key Parsing: The input is analyzed to determine its format (OpenSSH or PEM). OpenSSH public keys are split into their components: key type (e.g., ssh-rsa), Base64-encoded key data, and optional comment. PEM keys are extracted from between the BEGIN/END markers and Base64-decoded.
2. Wire Format Decoding: The Base64-encoded key data is decoded into raw binary bytes using the SSH wire format (RFC 4253). The first field contains the key type string (length-prefixed), followed by the key-specific fields like exponent and modulus for RSA keys, or the curve name and public point for ECDSA keys.
3. MD5 Fingerprint: The raw decoded key data is hashed using MD5, producing a 16-byte hash. Each byte is converted to a two-character hexadecimal value, and the values are joined with colons. For example: 2a:3b:4c:5d:6e:7f:80:91:a2:b3:c4:d5:e6:f7:08:19.
4. SHA256 Fingerprint:The raw decoded key data is hashed using SHA-256 via the browser's Web Crypto API (crypto.subtle.digest). The 32-byte hash is Base64-encoded with URL-safe characters (- instead of +, _ instead of /) and prefixed with SHA256:.

• MD5 (16 bytes, 32 hex chars): Traditional fingerprint format used by OpenSSH versions prior to 6.8. Produces shorter fingerprints that are easier to visually compare. However, MD5 is cryptographically broken and should not be used for security-critical verification. Modern systems still support MD5 fingerprints for backward compatibility with existing documentation and key databases that use the MD5 format.
• SHA256 (32 bytes, 43 Base64 chars): Current default fingerprint format used by OpenSSH 6.8+. SHA256 is cryptographically secure and is recommended for all new deployments. The Base64 encoding is more compact than the colon-separated hex format, and the hash is significantly stronger against collision attacks.
• Comparing Fingerprints: Both formats are computed from the same underlying key data, so the same key will always produce the same fingerprint (for the same hash algorithm). You can verify a key using either format - choose SHA256 for security, MD5 for compatibility with existing documentation.

Our Fingerprint Hash Generator processes everything entirely in your browser. SSH keys are read and parsed in-memory using the Web Crypto API and a pure JavaScript implementation - no data is ever uploaded to any server. The tool is 100% free with no signup, no account, and no usage limits.

Important limitations: The tool can only generate fingerprints from valid SSH public keys in OpenSSH or PEM format. PEM private keys are parsed on a best-effort basis - the internal structure varies by format (PKCS#1, PKCS#8, OpenSSH format), and key length estimation for some formats may be approximate. Password-protected private keys cannot be parsed because the tool does not handle decryption. For security reasons, never share your private keys - only public keys should be used for fingerprint verification.