When I create an SSH key pair, The public key auto contains a key fingerprint and comment.

I am not from the field of IS and I want to ask if a fingerprint is a must.

Thank you,


The public key does not contain a fingerprint. The fingerprint is computed by using a hash like MD5 or SHA-1 over the public key. See also Checking ssh public key fingerprints for how to get different fingerprints (using different algorithms) for the same key.

  • Oh I now saw I have only a line "comment" but not a line "fingerprint"... Can you please add only a few words in a parenthesis note if it is carried on, for example, when I load the public key to my VPS, I guess it is carried on somehow, inside the code/bits.
    – user123574
    Oct 18 '16 at 5:24
  • @Benia: again, the fingerprint is computed from the public key and not part of the public key. Thus wherever you have access to the public key (like in the SSH handshake) you can compute the fingerprint. Oct 18 '16 at 5:40
  • Oh I now understand you perfectly --- It is computed from it. Okay thank you!
    – user123574
    Oct 18 '16 at 5:41

Finger prints do not necessarily need to be created. They act as a means to identify the public key, and are created through message digest algorithms. For this reason they are smaller in size when compared to public keys

By default, whenever you connect to a remote shell via ssh its public key finger print gets stored in the known hosts file of client machine.

For example, if someone is trying to perform a man in middle attack between you and the server to which you have connected before, you will be alerted that the finger print changed. The reason for this is that there will be a mismatch between the previously stored finger print and the spoofed one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy