SSH Key Fingerprint Calculator

How it works

Everything happens locally: the middle field of the key line (the base64-encoded blob) is base64-decoded to raw bytes, those raw bytes are hashed with the Web Crypto API's crypto.subtle.digest('SHA-256', ...) — the browser's native cryptographic implementation, not a hand-rolled JavaScript re-implementation — and the resulting digest bytes are base64-encoded and have their trailing = padding stripped, giving the same SHA256:... string that ssh-keygen -E sha256 -lf prints. The key type and comment are read directly from the pasted line and are never hashed. The entire wire-format blob is hashed — not just the raw key material at the end of it — because that is exactly what ssh-keygen hashes too.

FAQ

What is an SSH key fingerprint actually for?

It's a short, easy-to-compare stand-in for a full public key. The most common use is verifying a server's host key over a trusted second channel before you accept an unfamiliar host — comparing a full key by eye isn't practical, but comparing a short fingerprint is.

Why does this only show SHA256 and not the older MD5 colon-format?

SHA256 is what modern ssh-keygen prints by default and is the only fingerprint format this tool supports. The browser's Web Crypto API has no built-in MD5 implementation, and hand-rolling one in JavaScript for a security-adjacent tool risks a subtle bug that isn't worth the trade-off for a legacy format OpenSSH itself has moved away from.