Free tools Windows power users keep installed
One-click scans. No signup required.
“Host key verification failed” means SSH could not match the server’s presented identity to the key it previously recorded for that host. That can happen after a legitimate server change, but it can also mean you have reached the wrong server. Before removing any saved key or accepting a replacement, verify the expected fingerprint with the server administrator or the provider’s official documentation. If you cannot confirm the identity, do not connect.
What the error means
When SSH connects to a server, it checks the server’s host key to help confirm that it is communicating with the expected machine. SSH keeps a record of hosts it has seen, usually in a known_hosts file. If the key presented for a host does not match the saved record, SSH stops the connection rather than silently trusting the difference. Git and other applications can show the same error when they use SSH underneath.
As an Amazon Associate I earn from qualifying purchases.
The warning alone does not tell you why the key differs. The server may have been rebuilt, its SSH keys may have been rotated, or your connection may be going to a different endpoint. A mismatch is a reason to verify, not proof of either a legitimate change or an attack. GitHub explains this behavior in its SSH troubleshooting guidance.
How to check the warning safely
- Read the complete message. Note the hostname, port if shown, key algorithm, presented fingerprint, and any line naming an offending record in a known-hosts file. Keep the fingerprint available for comparison.
- Confirm the endpoint. Check that the hostname and port are the ones you intended. If you connected using a short alias, review the SSH configuration or ask your administrator what endpoint that alias should use.
- Get the expected fingerprint from an authoritative source. Use the server owner’s official documentation or contact its administrator. For GitHub, use its published SSH key fingerprints. Compare the fingerprint for the key algorithm shown in your warning.
- Stop if you cannot verify it. Do not accept the new key just to get past the prompt. GitHub advises against connecting when there is no official source to confirm the server key.
- Only after verification, update the saved record. Remove or replace the entry for the specific host, then reconnect and accept the key only if its fingerprint matches the one you confirmed.
Update a known-hosts entry after confirming the new key
For a host whose saved entry is stale, ssh-keygen -R removes the matching entry from the known-hosts file. GitHub’s documented RSA key-update example uses:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh-keygen -R github.comUse the actual hostname involved in your connection, not github.com unless that is the host you are connecting to. If your SSH setup uses a non-default port, alias, or a different known-hosts file, identify the relevant entry and configuration first. Removing a record does not verify a replacement key; when you reconnect, compare the offered fingerprint with the authoritative one before accepting it.
GitHub has documented a real RSA host-key rotation, including a replacement key and this removal command. That example shows why a key can legitimately change, but it does not make an unexplained warning on another host safe to ignore. See GitHub’s RSA SSH host-key update notice for that specific event.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
GitHub fingerprints: verify against the live official page
The fingerprints below are GitHub-specific values reproduced from its published key information. Fingerprints can change, so check GitHub’s official fingerprint page at the time you troubleshoot rather than relying on a saved copy.
Recommended Free Tools
| Key algorithm | GitHub fingerprint |
|---|---|
| RSA | SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s |
| ECDSA | SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM |
| Ed25519 | SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU |
| DSA | SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ (GitHub labels this key “closing down.”) |
These values apply only when the endpoint is GitHub and the algorithm matches. They are not fingerprints for Git hosting services generally, private servers, or other providers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If the error continues after you update the entry
A persistent mismatch can mean SSH is checking a different record or endpoint than the one you changed. Check these details with the administrator or in your SSH configuration:
- Different known-hosts file: The client may be using another user’s file or a system-wide file.
- Different hostname or port: An alias, custom port, or alternate endpoint may map to a separate saved record.
- Multiple host keys: A server may have more than one legitimate key algorithm. Confirm which one is expected for your connection.
Do not disable host-key checking to suppress the warning. The host-key check verifies the server’s identity; it is separate from user authentication. Even after the server is verified, you still need valid credentials and access to the Git account or repository.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
