A run of forty hex characters that stands in for a key, printed in whatever grouping the software preferred.
The shape
Forty characters, drawn from the hex set only. The spaces you usually see are added for the benefit of human eyes and are not part of the value, which is why the same fingerprint can be printed several ways without being a different fingerprint.
- Total width
- forty characters, ignoring any spacing
- Alphabet
- hex, the digits and the letters up to
F, set out at alphabets - Case
- not significant; upper case is the common choice
- Grouping
- ten groups of four is the usual layout
- Wider gap
- some output puts extra space after the fifth group
- No grouping
- some output prints all forty with no spaces
- Newer form
- a newer key version prints sixty four hex characters instead
- Separators
- spaces where present; hyphens and colons are not part of this format
0123 4567 89AB CDEF 0123 4567 89AB CDEF 0123 4567
ten groups of four, forty characters in total
0123 4567 89AB CDEF 0123 4567 89AB CDEF 0123 4567
the same forty, with the wider gap after the fifth group
0123456789ABCDEF0123456789ABCDEF01234567
the same forty again, printed with no spacing at allPrinted forms you will meet
The variation is presentational, and knowing that saves a lot of pointless alarm when two copies of the same value look unlike each other.
| Form on the page | What has actually changed |
|---|---|
| Ten groups of four | spacing only; forty characters either way |
| Two blocks of five groups | one wider gap in the middle, same forty characters |
| One unbroken run | same value, considerably harder to read across |
| Lower case letters | same value; hex draws no distinction between cases |
| Sixty four characters | a different key version, not this value made longer |
The last row is the one that catches people out. A sixty four character string is not a fingerprint with more of itself shown; it belongs to a newer key format and is a separate value with its own grouping habits. If you are holding one of each, you are holding descriptions of two different things.
How to check it by eye
Reading forty characters without reading forty of them
- Count the groups before you read anything. Ten groups of four, or one run you can count in fours.
- When comparing two copies, treat each group of four as a single symbol and compare whole groups. Four characters is about as much as an eye takes in at once.
- Work inward from both ends: last group against last group, first against first, then the second from each end, and so on toward the middle.
- Stop at the first group that differs. A comparison that has failed does not become useful by continuing.
- Check for a letter past
F. One of those means the string is not hex, so it is not a fingerprint at all.
Comparing only the final group of four is the classic error, and it is worth being precise about why. The tail of a fingerprint is the part that gets quoted on its own as a short key id, so it is the most reproduced fragment of the whole value, and it is the smallest thing anyone would need to make agree. Checking the piece that is quoted everywhere and easiest to match is the weakest reading available, which is exactly why it feels quick.
What a wrong shape means
A count that comes out at thirty nine or forty one usually means a group lost or gained a character during a copy, and the group widths give it away faster than any counting does: nine groups of four and one group of three has a visible dent in it.
Letters past F mean the string came from a different alphabet, and the likely origin is something base64 or base32 that happened to be nearby. Colons or hyphens between groups mean the value was formatted by software that prints other kinds of identifier, so it was probably reformatted rather than mistyped.
What none of these mean is that somebody built a decoy. Fingerprints are copied by hand more often than almost anything else in this family, and hand copying produces exactly these faults.
What a correct shape does not prove
Forty valid hex characters is a very low bar. Any forty such characters clear it, including forty chosen at random.
- That the fingerprint was derived from the key printed above it. Both strings were placed on that page by whoever built the page, in whatever order suited them.
- That the key belongs to anyone the page names.
- That the value is current, rather than describing a key that has since been replaced.
- That two pages showing the same value are independent witnesses. They may be copies of one another.
- That anybody has compared it to anything. This site publishes no comparison and holds no reference value for any key.
A fingerprint is a label for a key. Reading the label carefully is worth doing, and it remains reading a label.
What this card is not
The eight and sixteen character forms taken from the end of this value have their own entry at a short key id and a long key id. The block that a fingerprint usually accompanies is at a public key block, and general technique for counting long strings is at counting by eye.
Questions people send about this shape
Why is a fingerprint printed in groups of four?
Grouping is a reading aid and nothing more. Forty characters in a row defeat the eye, while ten groups of four can be compared as ten units instead of forty. The spaces are added at printing time, are not part of the value, and can be removed or rearranged without changing what the fingerprint refers to.
Does the case of the letters matter?
No. Hex uses the digits and the first six letters, and the two cases mean the same digit. Software tends to print upper case because it separates the letters visually from the digits. A copy in lower case is the same value written differently, so a case difference between two copies is not a mismatch.
Is the sixty four character form a longer version of the same fingerprint?
No. It comes from a newer key version and is computed differently, so it is a separate value belonging to a separate object. You cannot shorten one into the other, and finding that a forty character value and a sixty four character value differ tells you only that they were never the same kind of thing.