SFTP Host Key Fingerprint Viewer
Retrieve the SSH host key fingerprint of any SFTP server. View key type and both MD5 and SHA256 fingerprints without needing credentials.
What is a host key fingerprint?
Every SSH/SFTP server has a unique host key pair. The fingerprint is a short hash of the public key that you can use to verify you’re connecting to the right server - not an imposter.
SSH clients store host key fingerprints in a known_hosts file. On first connect, they ask you to confirm the fingerprint. On subsequent connects, they verify it automatically. A changed fingerprint is a warning sign of a man-in-the-middle attack or a server rebuild.
SHA256 vs MD5
SHA256 fingerprints (the default in modern OpenSSH) are more secure and collision-resistant. MD5 fingerprints are still shown by some older clients. Both identify the same key.
Verified the fingerprint? An SFTP client that checks host keys on every connect does this for you automatically - FTPie verifies the server's identity each time and warns you if the key changes.
Check a fingerprint yourself
The value to compare against should come from the server's owner, not from the connection you are trying to verify. On the server itself, ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub prints the SHA256 fingerprint of its Ed25519 key; the RSA and ECDSA keys sit next to it in the same folder.
From a PC, the OpenSSH tools built into Windows 10 and 11 do the same as this page. In Command Prompt, ssh-keyscan sftp.example.com > keys.txt saves the server's public keys, and ssh-keygen -lf keys.txt lists their fingerprints. Add -E md5 to get the MD5 form when the fingerprint you were sent looks like a1:b2:c3:... rather than SHA256:.... A fingerprint cannot be converted from one form to the other; compare like with like.
A server usually has several host keys - Ed25519, ECDSA and RSA - and each has its own fingerprint. A mismatch is often just a different key type, so compare the fingerprint for the type your client actually received.
If the server was rebuilt and the new key is genuine, remove the old entry with ssh-keygen -R sftp.example.com and accept the new fingerprint on the next connection.