The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A public key hash is a short digest calculated from public-key data. In most protocols it is called a public key fingerprint, and people use it to check that a key they received matches the key they expected. There is no single universal calculation. Which bytes are hashed, which hash algorithm is used, and how the result is written out all depend on the protocol and the key version.
What the term means
A public key is often a long encoded value. A public key hash replaces that long value with a fixed-length digest computed from it. The digest is not a name, a certificate, or proof of identity by itself. It is a compact representation of one specific key, so two people can compare a short string instead of comparing the entire key.
As an Amazon Associate I earn from qualifying purchases.
The same idea appears under different labels. The standards use the term “public key fingerprint,” and that is the phrase most readers will see in SSH and OpenPGP documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why people compare hashes instead of full keys
RFC 4716, which defines the SSH public key file format, explains the motivation in Section 4: “Since public keys tend to be very large, it is difficult for a human to verify an entire host key.” A fingerprint solves that readability problem. It gives a person a value they can read aloud, copy, or compare against a stored reference.
#1 Best Overall
A match tells you only that the presented key equals the key that produced the reference value. Whether that reference can be trusted is a separate question, covered in the verification section below.
How the calculation changes between systems
The input bytes matter as much as the hash function. A protocol must define which key data is hashed and how that data is serialized or prefixed. RFC 4253, the SSH transport layer specification, represents an SSH public key or certificate with a format identifier followed by key or certificate data. A fingerprint built from one encoding will not match a fingerprint built from another, even when the underlying key is the same.
The table below compares the two specifications that define fingerprints in the most detail.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Item | SSH public key file format (RFC 4716) | OpenPGP version 4 key | OpenPGP version 6 key |
|---|---|---|---|
| Hashed input | Public-key data as specified by RFC 4253 | 0x99 octet, two-octet packet length, public-key packet | 0x9B octet, four-octet packet length, public-key packet |
| Digest algorithm | MD5, which the RFC describes as used for historical reasons | SHA-1 | SHA2-256 |
| Digest length | 16 octets | 160 bits | 256 bits |
| Written form | Lowercase hexadecimal pairs separated by colons | Not covered in this summary of the specification | Not covered in this summary of the specification |
SSH public key file format (RFC 4716)
For this format, the fingerprint is the MD5 digest of the public-key data specified by RFC 4253, shown as 16 octets in lowercase hexadecimal separated by colons. RFC 4716 notes that MD5 is used for historical reasons and that its collision resistance is weak. Treat this as the behavior of that specific SSH specification. Do not assume every SSH fingerprint you encounter is MD5. RFC 4251, the SSH architecture document, includes an example fingerprint computed with SHA-1, so SSH values can use more than one digest.
OpenPGP version 4 keys
RFC 9580 defines the OpenPGP fingerprint for each key version. For a version 4 key, the calculation runs in this order:
- Take the public-key packet for the key.
- Prepend the 0x99 octet and a two-octet packet length.
- Hash the result with SHA-1 to produce a 160-bit fingerprint.
OpenPGP version 6 keys
For a version 6 key, the same general idea changes in three places. The prefix is 0x9B, the length field is four octets, and the digest is SHA2-256, which produces 256 bits. A version 4 fingerprint and a version 6 fingerprint for the same key are therefore different values with different lengths.
Why the same key can produce different fingerprints
- Different ecosystems use different rules. An SSH fingerprint and an OpenPGP fingerprint are not interchangeable, even if both describe a key with the same mathematical parameters.
- Key versions change the construction. OpenPGP version 4 and version 6 differ in prefix, length field, and digest.
- Digest algorithms vary. MD5, SHA-1, and SHA2-256 all appear in the specifications discussed here, and their output lengths differ.
- Display formats differ. A value shown as colon-separated hexadecimal is the same kind of object as one shown in another encoding only after you convert it, and a comparison should be made in a single format.
How to verify a key with a fingerprint
A fingerprint is useful when you compare a key received through one channel against a trusted value obtained through another. SSH architecture guidance in RFC 4251 recommends a best-effort check of host keys, storing host keys for later comparison, and offering a way to reject host keys that cannot be verified. The steps below apply the same logic to any ecosystem.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Identify the ecosystem and key version. An SSH key, an OpenPGP version 4 key, and an OpenPGP version 6 key each have their own fingerprint rules.
- Obtain the expected value through a trusted channel, such as a fingerprint you verified in person, a value published by a trusted party, or an existing trust mechanism you already rely on.
- Generate or display the fingerprint in the format used by that system, with the same digest and encoding as the reference.
- Compare the full value, not only the first few characters.
- Store the verified value so later connections can be checked against it.
When a fingerprint does not match
A mismatch is a signal to investigate. It is not a reason to accept the new key automatically. Work through these checks before you decide what to do:
Best Value
- Confirm that both values use the same ecosystem, key version, digest algorithm, and encoding. A value calculated with MD5 cannot be compared with one calculated with SHA-256.
- Confirm that the reference value came from a source you trust, and not from the same channel that delivered the new key.
- Confirm that the key you received is the key you expected to receive. A legitimate key change can explain a mismatch, but it still needs to be verified.
- Reject the key if you cannot verify it through a trusted path.
Where the definition stops
A public key hash identifies the key data that was hashed. It does not identify a person, a server name, or an organization, and it does not confirm that a key is trustworthy. Those claims depend on how the reference value was obtained and on the trust process around it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
