I have a public key as the following 64 bytes encoded string


when I do a sha256 digest in python and print the result in base64 like this:

sha256 = hashlib.sha256()
hash_sha256 = sha256.digest()

I get a different fingerprint than when I do

ssh-keygen -lf key.pub

I thought the sha256 fingerprint was just the sha256 of the public key... I tried also adding exactly what's in the key.pub file, that is:

ssh-rsa ... user@host

but I also get a different result

So how exactly is the fingerprint calculated? The same applies to MD5?

2 Answers 2


Unfortunately you did not show the full code, i.e. did not make clear where plaintext in your code comes from. My guess is that you did not decode the base64 encoded public key first but just fed the encoded key directly into the digest. The following works for me:

b64pubkey='AAAAB3Nz....'  # base64 encoded public key
sha256 = hashlib.sha256()
hash_sha256 = sha256.digest()
  • 1
    And the traditional/obsolete MD5 version is computed on the same input, but displayed in hex with colons between octets. Feb 27, 2017 at 8:08
  • An important note: in case there's an 'ssh-rsa' prefix in the public key, it must be removed before generating the fingerprint. Apr 8, 2019 at 12:10
  • @dave_thompson_085 Do you know why now the fingerprint is given in base64 format instead of hex?
    – Rick
    Jun 26, 2019 at 10:47
  • 1
    @Rick: no, although I would guess it's because 32 bytes in hex is at least 64 chars (95 in the old format with colons) whereas 43 chars is just about the same as the old 47. Jun 27, 2019 at 3:48
  • @dave_thompson_085 Ya, I see some other users also guess that base64 wins because of shorter chars, compared to hex. Thanks for replying :)
    – Rick
    Jun 27, 2019 at 4:02

I would like to remind you that:

the base64 fingerprint calucuated by ssh-keygen will:

SSH by convention omits any trailing padding (the padding =s)

see my question here https://stackoverflow.com/questions/56769749/calculate-ssh-public-key-fingerprint-into-base64-why-do-i-have-an-extra

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .