Skip to content
All tools

Certificate Fingerprint Calculator

Get every fingerprint a certificate has, in the exact format each tool prints it, and check whether a value someone sent you really belongs to it.

Certificate

Paste one certificate or a whole chain, or upload a .pem/.crt/.cer/.der file. Every certificate found gets its own set of fingerprints.

Equivalent OpenSSL command

openssl x509 -in certificate.pem -noout -fingerprint -sha256
openssl x509 -in certificate.pem -noout -fingerprint -sha1
openssl x509 -in certificate.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256

Add -md5 for the MD5 value. The last line prints the public key (SPKI) hash that Chrome shows beside the certificate fingerprint.

What this calculates

A certificate fingerprint is a hash of the whole certificate as encoded in DER: the signed fields, the signature algorithm and the signature itself. It is not stored in the certificate; every viewer computes it on the spot, which is why each one can show a different algorithm. This tool prints SHA-256, SHA-1 and MD5 of the certificate, then the SHA-256 and SHA-1 of just the public key, and the Base64 form of the SHA-256 key hash that pinning configurations use.

Matching a value from another tool

Paste whatever you were given into the match box: a colon-separated OpenSSL line, a lowercase Chrome value, an uppercase PowerShell thumbprint or a SHA256:-prefixed pin. Separators, case and prefixes are stripped before comparing, as is the invisible left-to-right mark that the Windows dialog has a habit of copying along with the thumbprint. If nothing matches, the tool says what kind of hash the value looks like so you know whether you were comparing the right algorithm in the first place.

Which one should I write down?

Record the SHA-256 certificate fingerprint and label it as such. It is what Chrome, Firefox and current OpenSSL show by default, and it is safe to use in allowlists. SHA-1 is fine for looking up a certificate you already hold, which is what Windows and IIS use it for, but should not be the basis of a trust decision. MD5 is included only because some old appliances still print it. For the full story, read why the same certificate shows different fingerprints.

Frequently asked questions

Runs entirely in your browser. Certificates, keys and passwords you enter here are processed locally with JavaScript and are never uploaded or sent to any server — nothing is stored, logged or transmitted.