# Fingerprints

> SSH, X.509, SPKI-pin and OpenPGP fingerprints, cross-referenced between formats.

Category: Keys & Certificates · Page: https://util.caruana.me/tools/fingerprint/

## API, MCP and A2A

### Key and certificate fingerprints (`fingerprint`)

`GET|POST https://util.caruana.me/api/fingerprint` · MCP tool `fingerprint` · A2A skill `fingerprint` · [reference](https://util.caruana.me/reference/fingerprint/)

Finds every public key in `input` and returns its fingerprints in the formats other tools print. SSH: `ssh-keygen -l` SHA256 and MD5. Certificates: `openssl x509 -fingerprint` SHA-1 and SHA-256 over the DER, plus the RFC 7469 SPKI pin. PEM public keys: SHA-256 over the SubjectPublicKeyInfo. Where an equivalent exists, the SSH fingerprint of the same key is included, so you can confirm that a certificate and an SSH key share a key. OpenPGP: v4 (SHA-1) and v6 (SHA-256) fingerprints and key IDs for the primary key and subkeys. Private keys are refused.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `input` | string | yes | One or more SSH public key lines, RFC 4716 blocks, PEM `CERTIFICATE` / `PUBLIC KEY` blocks, or an armored PGP public key block. |

Privacy: The server receives the public key text, computes fingerprints in memory, and returns them. Public keys are not secret, but the input is not stored or logged (only the per-call metadata row is recorded). If the input contains a private key, the server rejects it before parsing; treat a private key sent anywhere you do not control as exposed.


## User guide

The tool sits in a window that works like a desktop app: menus on the top row and the **full-screen** icon at its right (**Esc** leaves full screen). **Help → Keyboard shortcuts…** lists the keys.

Paste one or more public keys or certificates, or open a file (`id_ed25519.pub`, `cert.pem`, `key.asc`, …). Each key found gets a card with fingerprints in the exact format the usual tool prints, so you can compare them character by character.

| You have                                             | Compare against                                                                | Shown as                              |
| ---------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------------------------- |
| SSH public key (`ssh-ed25519 AAAA…`)                 | `ssh-keygen -lf key.pub`, the "host key fingerprint" prompt, GitHub's key list | `SHA256:…` and `MD5:…`                |
| Certificate (`-----BEGIN CERTIFICATE-----`)          | `openssl x509 -noout -fingerprint -sha256`, browser certificate viewers        | colon-separated hex SHA-256 and SHA-1 |
| Public key PEM (`-----BEGIN PUBLIC KEY-----`)        | `openssl pkey -pubin -outform der \| openssl dgst -sha256`                     | colon-separated hex                   |
| Either of the two above, for pinning                 | HPKP, Android network security config, `curl --pinnedpubkey sha256//…`         | SPKI pin (Base64)                     |
| OpenPGP key (`-----BEGIN PGP PUBLIC KEY BLOCK-----`) | `gpg --fingerprint`, keyserver listings                                        | grouped hex fingerprint and key ID    |

**Same key in different formats.** For certificates and PEM public keys, the card also shows the **SSH fingerprint of the same key** (RSA, ECDSA P-256/384/521 and Ed25519). This answers questions like "is this server certificate using the same key as that SSH host key?".

**Private keys are refused.** If what you paste contains a private key, it is rejected before it is parsed. You never need a private key to compute a fingerprint. If you pasted one somewhere you do not control, treat it as exposed.

## Specification

**SSH** (RFC 4253 §6.6, RFC 4716, RFC 5656, RFC 8709).

- **Accepted input:**
  - `authorized_keys` and `known_hosts` lines; options or host patterns before the key type are skipped.
  - RFC 4716 `---- BEGIN SSH2 PUBLIC KEY ----` blocks.
  - The Base64 key data must decode, and its embedded key type must equal the stated type.
- **Fingerprints:**
  - `SHA256:` + Base64 (no padding) of SHA-256 over the decoded key blob, as `ssh-keygen -l` prints it.
  - `MD5:` + lowercase colon hex of MD5 over the same blob.
- **Key types:** `ssh-ed25519`, `ssh-rsa`, `ecdsa-sha2-nistp256/384/521`, `ssh-dss`, `ssh-ed448`, and the `sk-` security-key variants.

**X.509** (RFC 5280).

- **Fingerprints:** SHA-256 and SHA-1 over the certificate's DER encoding, as uppercase colon hex.
- **SPKI pin** (RFC 7469 `pin-sha256`): Base64 of SHA-256 over the DER SubjectPublicKeyInfo.

**PEM public keys.** The same SPKI hashes as for certificates, shown as hex and as a pin.

**SSH cross-reference.**

- **Method:** the SPKI key is imported with Web Crypto, exported as a JWK, and re-encoded in SSH wire format, then fingerprinted as above.
- **Curves SSH lacks** (and X25519) show no SSH fingerprint.

**OpenPGP** (RFC 9580 §5.5.4).

- **Armor:** ASCII armor is decoded. The CRC-24 checksum is verified when present; a mismatch is an error, because it means the text was damaged.
- **v4 keys:** fingerprint = SHA-1 over `0x99 ‖ 2-byte length ‖ key packet body`. Key ID = the last 8 bytes.
- **v6 keys:** fingerprint = SHA-256 over `0x9B ‖ 4-byte length ‖ body`. Key ID = the first 8 bytes. v5 keys use `0x9A`.
- **Subkeys** are listed with their own fingerprints.
- **User IDs** are shown as stored. Their self-signatures are **not** verified, so a user ID is a claim, not proof.

**Private-key detection.** Any `PRIVATE KEY` PEM label (PKCS#8, PKCS#1, SEC1, encrypted), `OPENSSH PRIVATE KEY`, `PGP PRIVATE KEY BLOCK`, or an OpenPGP secret-key packet causes rejection.