Get a Key or Host Fingerprint with ssh-keygen -lf

Compute the SHA256 fingerprint of any SSH public key or remote host key for verification.

macOSsshkeysssh-keygenLow risk

Run `ssh-keygen -lf <keyfile.pub>` to print a key's SHA256 fingerprint; pipe `ssh-keyscan` output in to fingerprint a host's key.

01Command

Command

$ ssh-keygen -lf ~/.ssh/id_ed25519.pub
# Fingerprint of a remote host key:
ssh-keyscan example.com | ssh-keygen -lf -

02What it does

`ssh-keygen -l -f file` prints the key type, bit size, and its SHA256 fingerprint — the same `SHA256:...` string GitHub, GitLab, and CI platforms display for comparison. Because fingerprints are short, they are the practical way to confirm you are pushing with the key you think you are, or that a host key matches the one you accepted before. Piping `ssh-keyscan host` into `ssh-keygen -lf -` fingerprints a remote server without opening an SSH session.

03Risk

RiskLow risk

!Warning: A fingerprint only proves key identity, not trust — compare it against a value obtained from a second channel.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

SSH-KEYGEN(1) — OpenBSD manual
OpenBSD · technical · 2026-09-17
Evidence: Documents -l (fingerprint), -f (file) and reading from stdin with -.

Last verified: 2026-09-17 · Category: Security & Privacy