When I run

ssh-keygen -lf my_key.pub

I get a fingerprint of the type:


When I do it to the same base64 encoded public key, but in python, with the code

    def to_sha_256(b64pubkey):
        sha256 = hashlib.sha256()
        hash_sha256 = sha256.digest()
        return hash_sha256
    def to_base_64(plaintext):
        return str(base64.b64encode(plaintext), 'utf-8')

    fingerprint = to_base_64(to_sha_256(b64pubkey))

I get


What is that = in the end and which one is correct?

1 Answer 1


base64 uses equal signs for padding if the number of encoded bytes is not a multiple of 3. However, the padding is not always mandatory and its use varies between implementations:

In theory, the padding character is not needed for decoding, since the number of missing bytes can be calculated from the number of Base64 digits. In some implementations, the padding character is mandatory, while for others it is not used.


For example, since this string has only 7 bytes, == is appended to pad the value to a multiple of 3:

$ echo -n "1234567" | base64

So both variants are correct. If in doubt, use the padded one.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .