Fingerprints
Paste a public key or certificate to get the fingerprints other tools print: ssh-keygen, openssl, GnuPG, and SPKI pins. Computed in your browser.
Several keys can be pasted at once. Private keys are refused without being parsed.
Where your data goes
| Using this page | Using the API, MCP or A2A | |
|---|---|---|
| Where it runs |
In your browser. Parsing and hashing run in the page using @noble/hashes, @peculiar/x509 and Web Crypto. Opening a file reads it from disk into the page; it is not uploaded. | In a Cloudflare Pages Function at the Cloudflare data centre nearest the caller. |
| What leaves your device | Nothing you enter. After the page and its scripts load, no request
carries your input. The browser enforces this: the page's Content-Security-Policy
sets connect-src 'none' and form-action 'none', which
block fetch, XHR, WebSocket, EventSource, beacons and form posts.
| The server receives the public key text, computes fingerprints in memory, and returns them. Public keys are not secret, but the input is not stored or logged (only the per-call metadata row is recorded). If the input contains a private key, the server rejects it before parsing; treat a private key sent anywhere you do not control as exposed. |
| Stored | Nothing leaves the page. No cookies, analytics or third-party scripts; the browser keeps only your View → Inline config choice. | Your inputs and results: never. What is stored is your client record (client ID, a SHA-256 hash of your secret, expiry, and the profile you registered with) and one metadata row per call: operation, time, transport, status, error code, duration, request and response sizes, and country. |
| Logged | Nothing (no requests are made). | Only the per-call metadata above, attributed to your client ID. Never parameters, bodies, results, or credentials. Cloudflare, as the host, also processes request metadata (IP address, full URL including the query string, headers) under its own policies, so put inputs in POST bodies. |
| Access | Open to anyone. | Requires a client ID and secret (how to get one). HTTPS only; TLS terminates at Cloudflare. |
Details and how to verify this yourself: Security & privacy.
User guide
The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). Help → Keyboard shortcuts… lists the keys.
Paste one or more public keys or certificates, or open a file (id_ed25519.pub, cert.pem, key.asc, …). Each key found gets a card with fingerprints in the exact format the usual tool prints, so you can compare them character by character.
| You have | Compare against | Shown as |
|---|---|---|
SSH public key (ssh-ed25519 AAAA…) | ssh-keygen -lf key.pub, the “host key fingerprint” prompt, GitHub’s key list | SHA256:… and MD5:… |
Certificate (-----BEGIN CERTIFICATE-----) | openssl x509 -noout -fingerprint -sha256, browser certificate viewers | colon-separated hex SHA-256 and SHA-1 |
Public key PEM (-----BEGIN PUBLIC KEY-----) | openssl pkey -pubin -outform der | openssl dgst -sha256 | colon-separated hex |
| Either of the two above, for pinning | HPKP, Android network security config, curl --pinnedpubkey sha256//… | SPKI pin (Base64) |
OpenPGP key (-----BEGIN PGP PUBLIC KEY BLOCK-----) | gpg --fingerprint, keyserver listings | grouped hex fingerprint and key ID |
Same key in different formats. For certificates and PEM public keys, the card also shows the SSH fingerprint of the same key (RSA, ECDSA P-256/384/521 and Ed25519). This answers questions like “is this server certificate using the same key as that SSH host key?”.
Private keys are refused. If what you paste contains a private key, it is rejected before it is parsed. You never need a private key to compute a fingerprint. If you pasted one somewhere you do not control, treat it as exposed.
Specification
SSH (RFC 4253 §6.6, RFC 4716, RFC 5656, RFC 8709).
- Accepted input:
authorized_keysandknown_hostslines; options or host patterns before the key type are skipped.- RFC 4716
---- BEGIN SSH2 PUBLIC KEY ----blocks. - The Base64 key data must decode, and its embedded key type must equal the stated type.
- Fingerprints:
SHA256:+ Base64 (no padding) of SHA-256 over the decoded key blob, asssh-keygen -lprints it.MD5:+ lowercase colon hex of MD5 over the same blob.
- Key types:
ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp256/384/521,ssh-dss,ssh-ed448, and thesk-security-key variants.
X.509 (RFC 5280).
- Fingerprints: SHA-256 and SHA-1 over the certificate’s DER encoding, as uppercase colon hex.
- SPKI pin (RFC 7469
pin-sha256): Base64 of SHA-256 over the DER SubjectPublicKeyInfo.
PEM public keys. The same SPKI hashes as for certificates, shown as hex and as a pin.
SSH cross-reference.
- Method: the SPKI key is imported with Web Crypto, exported as a JWK, and re-encoded in SSH wire format, then fingerprinted as above.
- Curves SSH lacks (and X25519) show no SSH fingerprint.
OpenPGP (RFC 9580 §5.5.4).
- Armor: ASCII armor is decoded. The CRC-24 checksum is verified when present; a mismatch is an error, because it means the text was damaged.
- v4 keys: fingerprint = SHA-1 over
0x99 ‖ 2-byte length ‖ key packet body. Key ID = the last 8 bytes. - v6 keys: fingerprint = SHA-256 over
0x9B ‖ 4-byte length ‖ body. Key ID = the first 8 bytes. v5 keys use0x9A. - Subkeys are listed with their own fingerprints.
- User IDs are shown as stored. Their self-signatures are not verified, so a user ID is a claim, not proof.
Private-key detection. Any PRIVATE KEY PEM label (PKCS#8, PKCS#1, SEC1, encrypted), OPENSSH PRIVATE KEY, PGP PRIVATE KEY BLOCK, or an OpenPGP secret-key packet causes rejection.
API & MCP
The same logic is available over HTTP and as MCP tools. Unlike this page, these run on the server: see where your data goes.