How do I compare SSH key fingerprints without exposing private keys?
Run ssh-keygen -lf against a public-key file to show its fingerprint. Compare the full fingerprint and algorithm across the client and the authorised server record. Comments and filenames can change without changing the key.
Instructions
1. Read the client public-key fingerprint
Use the exact public file corresponding to the private key selected by -i.
ssh-keygen -lf "$env:USERPROFILE\.ssh\server_ed25519.pub"This displays key size, fingerprint, comment and algorithm without printing the private key.
2. Inspect the enrolled account’s public keys
Use an already authenticated session for the intended Linux account. Custom server configurations may use a different authorised-key location.
ssh-keygen -lf "$HOME/.ssh/authorized_keys"For a standard authorised-key file, the output identifies its enrolled public keys. Confirm the actual account and configured path first.
3. Match the full values
Compare SHA256 values exactly, allowing for presentation differences in whitespace or comments. If the account uses centrally managed keys, obtain the public fingerprint from that authoritative source instead of assuming the local file controls access.
Check the result
- The full client fingerprint appears in the intended account’s authorised key inventory.
- The compared fingerprint belongs to a user key, not the server host key.
Troubleshooting
- The fingerprints differ
- You may be selecting another private key or checking the wrong server account.
- The file is absent
- The account may use another authorised-key path, certificates or managed identity lookup; inspect the applicable server configuration.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.