Skip to content
ecdsa.com

Key or certificate fingerprint

A short hash of a public key or certificate used to identify and compare it by eye or in configuration, such as SHA256:… for SSH keys or the SHA-256 of a certificate's DER bytes.
Also written askey fingerprintcertificate fingerprintthumbprintSHA256 fingerprint

Each ecosystem hashes something different. OpenSSH shows SHA256: plus unpadded base64 of the SHA-256 of the key blob (the default since OpenSSH 6.8; older tools print colon-separated MD5). An X.509 fingerprint is a hash of the whole DER certificate and is not a field inside it, so it changes on every renewal. An SPKI fingerprint (HPKP pins, pin-sha256, certificate transparency lookups) hashes only SubjectPublicKeyInfo and survives renewal with the same key. JWK thumbprints (RFC 7638) hash a canonical JSON of the required members. OpenPGP v4 fingerprints are SHA-1 (40 hex digits) and v6 fingerprints are SHA-256 (RFC 9580).

Two fingerprints match only if the same algorithm hashed the same encoding: an SSH SHA256 fingerprint and a sha256sum of the .pub file differ, as do a certificate fingerprint and an SPKI pin for the same key. Compare full values; short prefixes and "key art" can be ground by an attacker.

Standards and references

All terms