Why does my key show a different fingerprint than my server?

Different hash algorithms. Modern OpenSSH prints SHA256 in base64; older tools print MD5 in colon-separated hex. Compare like with like — ssh-keygen -lf -E md5 forces the legacy form.

Is it safe to share a fingerprint?

Yes. It is a hash of a public key and is meant to be published — that is how out-of-band verification works.

Can someone reconstruct my key from the fingerprint?

No. It is a one-way hash, and in any case the input is the public key, which is not secret.

Which key type should I generate?

Ed25519 for new keys: it is compact, fast and has no parameter choices to get wrong. RSA remains widely supported but requires at least 3072 bits to be current.

Security🌐 YAS server-sideAPI availableadvanced

SSH Key Fingerprint

Computes the fingerprint of an OpenSSH public key.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

OpenSSH public key

Loading tool…

What does this tool do?

Computes the fingerprint of an OpenSSH public key.

Why would I use it?

You want to verify a server key fingerprint against a known value.
You are auditing authorized_keys entries.
You want the SHA-256 fingerprint shown by ssh.

Real-life example

Input

ssh-rsa AAAAB3NzaC1yc2E...

Output

SHA256:j3f9a...

The fingerprint is a hash of the key material.

Input → Process → Output → Next

Input: Paste the public key line.
Process: YAS parses the key and hashes it.
Output: The SHA-256 fingerprint.
Next action: Compare it with the fingerprint your SSH client shows.

Common mistakes

Pasting a private key instead of the public key.
Including surrounding text or comments that break parsing.
Assuming fingerprint match = identity (verify via a trusted channel).

What the result means

Matching fingerprints mean the same key material.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/ssh-key-fingerprint

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/ssh-key-fingerprint" \
  -H "Content-Type: application/json" \
  -d '{"key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK3eyDY2BNmjqbvypHC8t9Pj99+8QZoE75QHMh4vYfku yas-example"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/ssh-key-fingerprint", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK3eyDY2BNmjqbvypHC8t9Pj99+8QZoE75QHMh4vYfku yas-example"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/ssh-key-fingerprint", json={"key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK3eyDY2BNmjqbvypHC8t9Pj99+8QZoE75QHMh4vYfku yas-example"})
data = r.json()

Field	Type	Required	Description
key	string	Yes	OpenSSH public key (ssh-rsa AAAA...)

Success response

{ "type": "ssh-ed25519", "bits": 256, "fingerprint": { "sha256": "SHA256:...", "sha1": "..." }, "comment": "yas-example" }

Show type, bits and SHA256/SHA1 fingerprint of an OpenSSH public key.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How SSH Key Fingerprint works

An OpenSSH public key line contains a key type, a base64-encoded blob and an optional comment. The blob is a length-prefixed wire encoding of the key's algorithm identifier and its public parameters. The fingerprint is a hash of that blob — modern OpenSSH shows base64-encoded SHA-256 (SHA256:...), while older tooling shows colon-separated hex MD5, which is why the same key appears to have two different fingerprints.

The fingerprint's job is to make a long key comparable by a human. Verifying a host key on first connection, or confirming that the key you just uploaded is the one you hold locally, means comparing a 43-character string rather than a 700-character blob. It is a comparison aid, not a secret.

When to use it: real-world scenarios

Verifying a server host key before accepting it

The prompt on first SSH connection asks you to confirm a fingerprint. Comparing it against the value your provider published out-of-band is the only step that prevents a machine-in-the-middle.

Identifying which key an account is using

GitHub, GitLab and cloud consoles list fingerprints, not keys. Fingerprinting your local public keys tells you which entry corresponds to which file.

Auditing authorized_keys

Fingerprinting every line turns an unreadable file into a list you can reconcile against a roster of people who should still have access.

Confirming a key survived transfer

Keys pasted through chat clients get line-wrapped or truncated. Matching fingerprints proves the copy is intact.

Pro tips

Compare the full fingerprint, not the first and last few characters. Partial comparison is exactly what a prepared attacker plans for.
Prefer Ed25519 keys: short, fast and without RSA's key-size decisions. Use RSA at 3072 bits or more only where Ed25519 is unsupported.
The comment field is free text and often contains a username and hostname. It is metadata, not identity, and can say anything.
Never paste a private key anywhere. A private key file begins with BEGIN OPENSSH PRIVATE KEY; only the .pub file should ever leave your machine.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Public keys only. Private key material is neither required nor accepted.
A fingerprint proves which key it is, not whether the key is trustworthy — trust comes from the channel that published the expected value.
MD5 fingerprints are shown only for compatibility with legacy output; SHA-256 is the meaningful form.
Certificate-based SSH authentication (signed principals) is a different model and is not covered here.

Frequently asked questions

Why does my key show a different fingerprint than my server?: Different hash algorithms. Modern OpenSSH prints SHA256 in base64; older tools print MD5 in colon-separated hex. Compare like with like — ssh-keygen -lf -E md5 forces the legacy form.
Is it safe to share a fingerprint?: Yes. It is a hash of a public key and is meant to be published — that is how out-of-band verification works.
Can someone reconstruct my key from the fingerprint?: No. It is a one-way hash, and in any case the input is the public key, which is not secret.
Which key type should I generate?: Ed25519 for new keys: it is compact, fast and has no parameter choices to get wrong. RSA remains widely supported but requires at least 3072 bits to be current.