What is an SSH key fingerprint
An SSH public key is a long string of letters and digits. It is hard to read out, hard to compare by eye, and easy to get wrong. A fingerprint is a short summary of that key, made by running the key through a hash function. The same key always gives the same fingerprint, and two different keys give different ones. That makes it handy for checking that the key you see is the key you expect.
Why SHA256 replaced MD5
Older tools showed the fingerprint as MD5, written as sixteen pairs of hex digits with colons. MD5 is broken: people can build two different inputs with the same MD5 value. For SSH this was mostly a theory problem, but OpenSSH 6.8 switched the default to SHA256 in 2015. A SHA256 fingerprint is written in base64 with the prefix SHA256: and no padding, for example SHA256:Nb2k.... This page shows both, so you can compare against old documents and new ones.
Checking a server on first connect
The first time you connect to a server, SSH prints "The authenticity of host can't be established" along with the host key fingerprint and asks if you want to continue. If you type yes without checking, you trust whoever answered. To check, get the fingerprint from a second path you trust: your hosting provider's console, the server's own console, or a colleague. On the server, run ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. If the value is the same as the prompt, answer yes. SSH then saves the key in known_hosts and warns you loudly if it ever changes.
Reading ssh-keygen -lf
The command ssh-keygen -lf key.pub prints four things: the size in bits, the fingerprint, the comment, and the type in brackets. Add -E md5 to get the old form, and -lv to draw the randomart picture. The randomart is the same fingerprint drawn as a small picture, so a change is easy to spot. This page prints the same values and the same picture for any public key line you paste.
Which key type to use today
Use Ed25519 first. Its keys are short, quick and hard to misuse, and every OpenSSH since 6.5 supports it. If you carry a hardware security key, the sk-ssh-ed25519 type keeps the private half on the device. ECDSA on P-256 or P-384 is fine but offers no gain over Ed25519. RSA is fine at 3072 bits or more, and 2048 is the minimum. Use RSA only for old systems that cannot read Ed25519.
What to do with old DSA and RSA-1024 keys
DSA keys (ssh-dss) are limited to 1024 bits, and OpenSSH has turned them off by default since version 7.0. RSA keys under 2048 bits are too small. Do not wait for a login to fail. Make a new Ed25519 key with ssh-keygen -t ed25519, add the new public key to the server's authorized_keys, test a login with it in a second window, and then delete the old line. Remove the old key from every server and every service, such as Git hosts, where you uploaded it.
Keep private keys private
Only paste public keys here, or anywhere. A private key file starts with a line that says BEGIN OPENSSH PRIVATE KEY or similar. If a private key was ever pasted into a chat, a ticket or a website, treat it as lost and replace it.
Frequently asked questions
Does this page send my key anywhere?
No. The fingerprint is worked out inside this page, and the page blocks network connections with a content security policy. There is no tracking and no analytics. You can turn off your connection after the page loads and it still works. A public key is not secret, but it is still yours to share or not.
Is it safe to paste a public key?
Yes. A public key is meant to be shared; that is why servers keep copies of it. Never paste a private key. If the text contains the words PRIVATE KEY, this page refuses to read it, clears the box and tells you so.
Which line should I paste?
Paste the contents of a .pub file, such as ~/.ssh/id_ed25519.pub, or lines from authorized_keys or known_hosts. Each line is read on its own, so you can paste many at once. Lines that start with a host name, as in known_hosts, are handled, and so are lines with options in front.
Why do the fingerprints not match what my server printed?
Check that you compare the same hash. Modern OpenSSH shows SHA256 with a base64 value that starts with SHA256:. Older tools show MD5 as colon-separated hex. Also check you pasted the key of the right type: a server has one host key per type, and the prompt shows only the one used for that connection.
What is the picture made of dots and letters?
It is the randomart, a small picture that OpenSSH draws from the fingerprint so that people can spot a change at a glance. It is made by the drunken bishop algorithm and matches what ssh-keygen -lv prints for the same key. Two different keys almost never give the same picture.
Is Ed25519 really better than RSA?
For most uses, yes. Ed25519 keys are short, fast and have few ways to go wrong. RSA is still safe at 3072 bits or more and works with very old software. If a system you must reach does not accept Ed25519, use RSA 4096 for that one case.
What does the weak verdict mean?
It means the key type or size is no longer considered safe or is turned off in current OpenSSH. DSA keys and RSA keys under 2048 bits get this verdict. Make a new key, add it to the server, test it, and then remove the old one.
Does it read certificates and private key files?
No on both. OpenSSH certificates are a different format and show a message instead of a result. Private keys are refused on purpose. If you need the fingerprint of a private key, run ssh-keygen -lf on your own machine, which reads the matching public key.