SSH Key Fingerprint Checker
Paste an OpenSSH public key to inspect it: key type, bit length, SHA256 fingerprint (the same format OpenSSH prints) and the legacy MD5 fingerprint. Weak and legacy key types get a clear warning. Everything runs in your browser — your key never leaves the page.
- Key type
- Key length
- Comment
- SHA256 fingerprint
- MD5 fingerprint
- Raw blob size
How it works
- The key is split into its three parts: the key type name, the base64-encoded key blob, and the optional comment.
- The blob is decoded and parsed field by field, exactly like the OpenSSH binary format (each field is a 4-byte length followed by that many bytes).
- The SHA256 fingerprint is the base64 of the SHA256 hash of the raw blob, without padding, prefixed with
SHA256:— identical to whatssh-keygen -lprints. - The MD5 fingerprint is the hex digest of the blob with a colon between every byte pair, matching the legacy OpenSSH format.
- ssh-dss and ssh-rsa1 are legacy types and are flagged. RSA keys shorter than 2048 bits are flagged as weak.
Frequently Asked Questions (FAQ)
What input does the SSH Key Fingerprint Checker need?
You paste one OpenSSH public key line, which has three parts: the key type name, the base64-encoded key blob and an optional comment.
What details does it show about a key?
It shows the key type, key length in bits, the comment, the SHA256 fingerprint in the same format OpenSSH prints, the legacy MD5 fingerprint and the raw blob size.
Does it warn about weak keys?
Yes. ssh-dss and ssh-rsa1 are flagged as legacy types, and RSA keys shorter than 2048 bits are flagged as weak, with advice on what to use instead.
Is my key uploaded anywhere?
No. The page states that everything runs in your browser, so your key never leaves the page.