SSH Key Fingerprint Checker (SHA256 and MD5)

This SSH key fingerprint checker shows the SHA256 and MD5 fingerprints of SSH public keys, the same values ssh-keygen -l prints and SSH clients show when you first connect, so you can check which key is which in an authorized_keys file. It runs entirely in your browser: nothing you type is sent to our server.

Public keys only

Paste .pub files or lines from authorized_keys or known_hosts. Options before the key (from=”…”, no-pty) and known_hosts host fields are recognised and shown. Anything that looks like a private key is cleared and refused without being read. Never paste a private key into any website.

Checking fingerprints on the server

# every key in a user's authorized_keys
ssh-keygen -lf ~/.ssh/authorized_keys
# the server's host keys (what clients see on first connect)
for f in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$f"; done
# MD5 format, as older clients show it
ssh-keygen -lf key.pub -E md5

Key strength

• Ed25519: recommended for new keys.
• RSA: 3072 bits or more is strong, 2048 is acceptable, under 2048 should be replaced.
• ECDSA: fine; Ed25519 is preferred.
• DSA: disabled by default since OpenSSH 7.0 and removed in OpenSSH 10.0; replace it.

To lock down SSH further, see hardening SSH on AlmaLinux 9.

How we checked it

On 11-12 October 2026 we generated RSA (1024, 2048 and 3072 bits), Ed25519 and ECDSA (256, 384, 521) keys with OpenSSH 9.6 and compared all 14 SHA256 and MD5 fingerprints with ssh-keygen -l: every one matched. We also tested authorized_keys options, known_hosts lines and the private-key refusal.

Frequently asked questions