Skip to content
Create free account
Create free account
LearnPublic key fingerprint

What is a public key fingerprint?

Also known askey fingerprint
Example. Kiteline is a fictional company.
On this page

A public key fingerprint is a short string computed from a public key with a hash function, short enough for two people to read aloud or compare on two screens, so they can confirm they are looking at the same key.

Why fingerprints exist

Public-key cryptography protects data once you have the right public key. It leaves one question open: is this key really theirs? If someone in the middle swaps in their own key, encryption and signatures still work, only for the wrong party. Full public keys are long and hard to compare, so systems show a digest instead.

OpenSSH is a familiar example. ssh-keygen -l prints the fingerprint of a key, and its manual lists SHA-256 as the default hash.

A fingerprint check only helps if the comparison happens over a channel the attacker does not control: in person, on a call, or by looking at both screens. Copying a fingerprint from the same message that delivered the key proves nothing.

How Crunu uses fingerprints

Crunu shows fingerprints as four groups of four characters, for example HTO5 H2HP IIG5 UO5H. They appear at the moments when a new key joins an organization:

  • New members. A person who accepts an invitation compares their key fingerprint with an admin. The admin confirms the member only after the fingerprints match, and environment access is granted after that confirmation.
  • New machines. On the server, crunu enroll prints the machine's fingerprint. The admin compares it with the one shown in the web app and approves the machine only if they match.
  • Your own account. Your profile shows the fingerprint of your key, so a teammate can check it.

If a compromised server tried to slip in its own key at one of these steps, the fingerprint would not match. That is why the comparison is worth doing even when it feels routine.

The same idea protects the organization itself. After you join, your devices pin the organization's signing key, so a server cannot later present a different organization under the same name.

Shell
printf '%s\n' "$CODE" | sudo crunu enroll --server https://vault.company.example -

The enrollment code is read from standard input, not from a command-line argument, and the command prints the fingerprint to compare. See invite your team, install the agent and crunu enroll and the daemon.

Sources

From the blog

  • Security

    Why a vault vendor can’t reset your password

    With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.

  • CI/CD

    Giving CI only the secrets it needs

    Long-lived CI tokens work from anywhere until revoked. How to scope pipeline secrets, keep production out of CI, and bind tokens to a repo with OIDC.

  • Security

    One key per environment: why dev must not open prod

    Most tools separate dev and prod with permissions the server enforces. Why the boundary is stronger when each environment has its own encryption key.