Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I always find that I get this message when I ssh into a new machine:


What does it stand for? Will every machine have the same fingerprint every time?

How are these fingerprints generated? What parameters do they depend on?

share|improve this question
up vote 30 down vote accepted

The fingerprint is based on the Host's Public key, usually based on "/etc/ssh/" Generally its for easy identification/verification of the host you are connecting to.

If the fingerprint changes, the machine you are connecting to has changed their public key. This may not be a bad thing(happens from re-installing ssh), but it could also indicate that you are connecting to a different machine at the same domain/IP(happens when you are connecting through something like load balancer) or that you are being targeted with a man-in-the-middle attack, where the attacker is somehow intercepting/rerouting your ssh connection to connect to a different host which could be snooping your user/pw.

Bottom line: if you get warned of a changed fingerprint, be cautious and double check that you're actually connecting to the correct host over a secure connection. Though most of the time this is harmless, it can be an indication of a potential issue


share|improve this answer
" cautious and double check that you're actually connecting to the correct host over a secure connection" -- stupid question, but how can you do this easily? – Savara Aug 10 '15 at 11:00

You can generate a fingerprint for a public key using ssh-keygen like so:

ssh-keygen -lf /path/to/

Concrete example (if you use an RSA public key):

$ ssh-keygen -lf ~/.ssh/
2048 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff /Users/username/.ssh/ (RSA)

The first part (2048) is the key length in bits, second part (00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff) is the fingerprint of the public key and the third part is location of the public key file itself.

share|improve this answer
do u know how to translate into 12:f8:7e:78:61:b4:bf:e2:de:24:15:96:4e:d4:72:53 this format from that public key? – Kit Ho Jul 24 '12 at 16:37
@KitHo I'm not sure if I understand your question. I updated the example, as I think ssh-keygen -lf will do what you want. – Benjamin Oakes Jul 24 '12 at 18:53
When SSH-ing into a new machine, what one sees is not a user's pubkey fingerprint, but the host's pubkey fingerprint. So a better example for the question's context is ssh-keygen -lf /etc/ssh/ It shows the fingerprint that is also shown on SSH logins to localhost. – tanius Aug 25 '14 at 0:26
My ssh-keygen reported sha256 fingerprints. In order to get md5 fingerprints I ran ssh-keygen -l -E md5 -f ~/.ssh/ #archlinux – Justin C Oct 28 '15 at 22:03
(@JustinC) OpenSSH versions 6.8 (March 2015) and up changed to SHA256, displayed in base64 rather than hex, by default. For the client use ssh -o FingerprintHash=md5 or the equivalent in ssh_config and on things that use ssh like scp. – dave_thompson_085 Jun 12 at 19:36

The fingerprint is the MD5 of the Base64-encoded public key.

$ ssh-keygen -f foo
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in foo.
Your public key has been saved in
The key fingerprint is:
65:30:38:96:35:56:4f:64:64:e8:e3:a4:7d:59:3e:19 andrew@localhost
The key's randomart image is:
+--[ RSA 2048]----+
|       +*..+*    |
|      =. +.=     |
|     . . .o .    |
|         o+   E  |
|        S= . + o |
|        . o o +  |
|           .   . |
|                 |
|                 |
$ cat
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEbKq5U57fhzQ3SBbs3NVmgY2ouYZfPhc6cXBNEFpRT3T100fnbkYw+EHi76nwsp+uGxk08kh4GG881DrgotptrJj2dJxXpWp/SFdVu5S9fFU6l6dCTC9IBYYCCV8PvXbBZ3oDZyyyJT7/vXSaUdbk3x9MeNlYrgItm2KY6MdHYEg8R994Sspn1sE4Ydey5DfG/WNWVrzFCI0sWI3yj4zuCcUXFz9sEG8fIYikD9rNuohiMenWjkj6oLTwZGVW2q4wRL0051XBkmfnPD/H6gqOML9MbZQ8D6/+az0yF9oD61SkifhBNBRRNaIab/Np7XD61siR8zNMG/vCKjFGICnp andrew@localhost
$ echo 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDEbKq5U57fhzQ3SBbs3NVmgY2ouYZfPhc6cXBNEFpRT3T100fnbkYw+EHi76nwsp+uGxk08kh4GG881DrgotptrJj2dJxXpWp/SFdVu5S9fFU6l6dCTC9IBYYCCV8PvXbBZ3oDZyyyJT7/vXSaUdbk3x9MeNlYrgItm2KY6MdHYEg8R994Sspn1sE4Ydey5DfG/WNWVrzFCI0sWI3yj4zuCcUXFz9sEG8fIYikD9rNuohiMenWjkj6oLTwZGVW2q4wRL0051XBkmfnPD/H6gqOML9MbZQ8D6/+az0yF9oD61SkifhBNBRRNaIab/Np7XD61siR8zNMG/vCKjFGICnp' \
    | base64 -D | md5

The md5sum 6530389635564f6464e8e3a47d593e19 is the fingerprint displayed when the key is generated, only without the separating colons.

However, if you’re dealing with the fingerprints that Amazon shows in the EC2 Key Pairs console, unfortunately that may be a different beast. If it’s 32 bytes, it’s the standard MD5 SSH public key fingerprint above. But if it’s 40 bytes, it’s actually a fingerprint computed by taking the SHA1 of the private key in PKCS#8 format:

$ openssl pkcs8 -in foo -nocrypt -topk8 -outform DER | openssl sha1 -c
share|improve this answer
I found this answer helpful in the following scenario. Your system uses SHA1 to calculate the fingerprint, but your friend's uses md5. I shared a fingerprint which was SHA1 and it didn't match the MD5 her system generated. This helped - thank you! sed 's|^ssh-rsa ||' /etc/ssh/ |sed 's|==.*$|==|' |base64 -d| md5sum – Liczyrzepa Jun 5 '15 at 19:25
I found this very helpful as well. Thanks! – Will Aug 19 '15 at 6:58
This is highly relevant in understanding why this fingerprint will not match those in DNS SSHFP records, because they use SHA-1 or SHA-256 digests. – neirbowj Dec 30 '15 at 21:28
@Liczyrzepa the publickey field may or may not have '==' at the end depending on the key type and bitsize; safer and IMO easier to use awk '{print $2}' /path/to/ or similar. – dave_thompson_085 Jun 12 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .