Fingerprints
A fingerprint is a hash of the public key blob, short enough to compare by eye. OpenSSH shows SHA-256 in Base64 (SHA256:…) since version 6.8; the older MD5:xx:xx:… form is what GitHub, AWS and old documentation still show for some keys. Both are computed here from the same bytes that ssh-keygen -lf key.pub hashes, so they match exactly. Use them to confirm a key in authorized_keys is the one you think, to match a host key warning against the server's ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub, and to identify keys in cloud consoles.
Key types
| Type | Size | Verdict |
|---|---|---|
| ssh-ed25519 | 256-bit | Best choice: small, fast, no parameter mistakes possible. Supported since OpenSSH 6.5 (2014). |
| ssh-rsa | 2048–4096 | Fine with SHA-2 signatures (rsa-sha2-256/512, automatic in current OpenSSH); 3072+ bits for new keys. The key type name is the same whether SHA-1 or SHA-2 signatures are used. |
| ecdsa-sha2-nistp256/384/521 | 256–521 | Fine, but Ed25519 is preferred; NIST curves depend on good randomness at signing time. |
| ssh-dss | 1024 | Obsolete; disabled by default since 7.0 and removed in 9.8. |
| [email protected] | 256 | Key stored on a FIDO2 security key (YubiKey); needs a touch per use. |
Formats
The OpenSSH one-liner is type base64-blob comment, where the blob is the type name and the key fields as length-prefixed strings. PEM PUBLIC KEY (SubjectPublicKeyInfo) is what OpenSSL, JWT libraries, and most non-SSH software want. ssh-keygen -e -m PKCS8 -f key.pub converts in one direction and ssh-keygen -i -m PKCS8 in the other; this page does both without the flags.
Locking down a key
Options at the start of an authorized_keys line restrict what the key can do: from= limits source addresses, command= forces a single command (the original is available in $SSH_ORIGINAL_COMMAND), and restrict disables forwarding, PTY and agent in one word. A backup key should be restrict,command="rrsync /backup"; a deploy key should allow nothing but the deploy script.
Questions
How do I get my public key?
cat ~/.ssh/id_ed25519.pub (or id_rsa.pub). If you only have the private key: ssh-keygen -y -f ~/.ssh/id_ed25519 prints the public part. Never paste the private key (the file without .pub) anywhere.
Why does GitHub show a different fingerprint?
GitHub shows SHA256 fingerprints for keys added since 2018 and MD5 for older ones. Compare the matching format; both are shown here. Also make sure you are looking at the same key file.
How do I verify a server’s host key fingerprint?
On the server: ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. Compare with what the client prints on first connection. Cloud providers show it in the console or serial log; GitHub publishes its fingerprints in its documentation.
Can this convert a private key?
No, by design. Private key conversion belongs on your own machine: ssh-keygen -p -m PEM -f key (OpenSSH → PEM) or ssh-keygen -p -m RFC4716. Nothing you paste here is sent anywhere, but a private key should never enter a browser at all.