All tools

SSH Known Hosts Fingerprint Checker

Hash

Parse an ssh_known_hosts file and compute each key's SHA256/MD5 fingerprint, decode its type and bit length, and flag weak or deprecated keys

Paste an ssh_known_hosts file, or a single `host keytype base64key` line, to compute each entry's SHA256 and MD5 fingerprint the exact way ssh-keygen -lf does. It decodes the key type and, for RSA keys, the modulus bit length straight from the key's own wire-format bytes, so it can flag an RSA key under 2048 bits or a deprecated ssh-dss (DSA) key as weak. This is useful for auditing a known_hosts file for outdated host keys, or for double-checking a fingerprint you were given over a different channel before trusting a new host. It only reads the public key material already present in the file and never touches a private key.

sshfingerprintsecurityknown-hostssha256

How to use SSH Known Hosts Fingerprint Checker

  • 1.Paste one or more known_hosts lines, or a whole known_hosts file.
  • 2.Read off each entry's SHA256 and MD5 fingerprint, key type, and bit length.
  • 3.Look for a WEAK flag on any RSA key under 2048 bits or any ssh-dss key, and consider rotating that host key.

Frequently asked questions

Does the SHA256 fingerprint match what ssh-keygen -lf shows?
Yes, it's computed the same way: base64-encode (no padding) the SHA-256 digest of the raw decoded key blob, matching OpenSSH's own fingerprint format exactly.
Why flag RSA keys under 2048 bits as weak?
A 1024-bit RSA key is considered too small for current security standards and is deprecated by most SSH implementations; 2048 bits or higher is the accepted minimum today.
Does this work with @cert-authority or @revoked lines?
Yes, those markers are recognized and skipped so the host, key type, and key fields are still parsed correctly from the rest of the line.
Can this read a private key file?
No, it only parses the public key material in a known_hosts-style line. It has no code path that reads or needs a private key.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/ssh-known-hosts-fingerprint-checker \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"input":"example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPgoxEP6yy3WPraZXnSJFc9Ly5tby6R7TVyMeAOuYORR"}'

Get an API key from your dashboard · Full API docs →

Related tools

JWK Thumbprint CalculatorCompute the RFC 7638 thumbprint of a JSON Web Key: canonicalize its required members and hash them with SHA-256, SHA-384, or SHA-512.JWTAWS IAM Policy Explainer (AI)Paste an AWS IAM policy document and get a plain-English, statement-by-statement walkthrough plus a list of concrete issues worth fixing, powered by GPT-4o miniCodeClear-Site-Data Header BuilderBuild a Clear-Site-Data response header from cache, cookies, storage, and executionContexts directives (or * for all of them), or parse an existing header back into its directivesNetwork