ssh-keygen -lf: show the fingerprint of an SSH key

ssh-keygen -lf ~/.ssh/id_ed25519.pub prints the key's size, its SHA256 fingerprint, the comment and the key type. This is the same fingerprint that ssh shows when it asks you to confirm a new host and that GitHub, GitLab and cloud consoles list next to your keys. -l means "show fingerprint", -f names the file; a private key file works too, since ssh-keygen derives the public key from it.

Fingerprint of a public key

cat > demo_key.pub <<'EOF'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7liivUmB831x3sTnW0fpJ1mBgKrhFvZ+soMxaQKrU7 demo@example
EOF
ssh-keygen -lf demo_key.pub
ssh-keygen -E md5 -lf demo_key.pub

256 SHA256:7W/TnHUXpdxOoF93UBNC3cMB0+3cNjF/Rvt9xNzP7eQ demo@example (ED25519)
256 MD5:81:b4:75:64:70:ef:b8:9f:7f:69:d9:04:1c:9b:0f:9e demo@example (ED25519)

The output fields are: key size in bits, fingerprint, comment, type. OpenSSH 6.8 and later default to SHA256 (base64, no padding). -E md5 prints the older hexadecimal format with colons, which older tools and older OpenSSH versions show.

Visual fingerprint

cat > demo_key.pub <<'EOF'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7liivUmB831x3sTnW0fpJ1mBgKrhFvZ+soMxaQKrU7 demo@example
EOF
ssh-keygen -lvf demo_key.pub

256 SHA256:7W/TnHUXpdxOoF93UBNC3cMB0+3cNjF/Rvt9xNzP7eQ demo@example (ED25519)
+--[ED25519 256]--+
|            .===*|
|              =B*|
|             o @X|
|         .  . o+^|
|        S .  . O@|
|         .    . &|
|          .  o *+|
|           .o + E|
|           ...   |
+----[SHA256]-----+

-v adds the "randomart" image, which is easier to compare by eye than a string.

Fingerprints of a server's host keys

# from the server itself
for f in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$f"; done

# from a client, without logging in
ssh-keyscan -t ed25519 server.example.org 2>/dev/null | ssh-keygen -lf -

# what your known_hosts file stores for a host
ssh-keygen -lF server.example.org

-F searches a known_hosts file (by default ~/.ssh/known_hosts, or the file given with -f) and -l turns the matches into fingerprints:

echo "server.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7liivUmB831x3sTnW0fpJ1mBgKrhFvZ+soMxaQKrU7" > known_hosts
ssh-keygen -lF server.example.org -f known_hosts

# Host server.example.org found: line 1
server.example.org ED25519 SHA256:7W/TnHUXpdxOoF93UBNC3cMB0+3cNjF/Rvt9xNzP7eQ

Compare the fingerprint from the server (or from your provider's console) with the one ssh shows on first connection before you answer yes.