Show a key's fingerprint
Show the fingerprint of a key with ssh-keygen -lf. The default hash is SHA256, and -E md5 prints the older format that some web consoles still list.
A server or a Git host shows a key fingerprint, and you need to compare it with a key file on disk.
cat > demo.pub <<'KEY'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMXTHyZYWyZKOy1gZ8JaUn09OJbfK5EqWb3sYAbPZ6x1 [email protected]
KEY
ssh-keygen -lf demo.pub
ssh-keygen -E md5 -lf demo.pub256 SHA256:eP3oipHQkU1Tbh0QaXvwNrd480QCmQui6cZI/VafoJo [email protected] (ED25519)
256 MD5:a3:10:1c:db:33:1e:f5:5f:11:3d:ed:26:38:b1:e2:0a [email protected] (ED25519)-l prints the length, fingerprint, comment and type of a key, and -f names the file. Since OpenSSH 6.8 the default hash is SHA256 in base64, as noted in the ssh-keygen manual, while -E md5 gives the colon separated hex form that older tools and some cloud consoles display. The same command works on a private key file or on a certificate.
A fingerprint identifies a key, not a person, so compare it over a channel you already trust. The SHA256 and MD5 forms never match each other, and a mismatch between two formats is not a sign of tampering. Pass -v to add the randomart image, which is easier to eyeball than the hash.