Skip to main content

Authorized use only. Use this tool solely on systems, tokens, and assets you own or are explicitly permitted to test — credential extraction, signature forging, and unauthorized access are prohibited by our Acceptable Use Policy.

X.509 Certificate Fingerprint

SHA-1 / SHA-256 / SHA-384 / SHA-512 thumbprints from a PEM certificate — computed locally

Certificate (PEM)

About the Certificate Fingerprint

Certificate fingerprints — the SHA-1 or SHA-256 hash of a certificate’s DER encoding — are how certificates are identified in SAML key descriptors, SSH host key warnings, certificate pinning configs, and enterprise trust lists. When a partner asks for your cert thumbprint, they want this hash, not the PEM.

Paste a PEM certificate and this tool computes SHA-1, SHA-256, SHA-384, and SHA-512 fingerprints locally with the Web Crypto API, in both colon-separated and plain hex forms. The values match OpenSSL’s x509 -fingerprint output exactly because they are computed over the same DER bytes.

How to use

  1. Paste the certificate PEM (BEGIN CERTIFICATE block).
  2. Click calculate — all four digests appear instantly.
  3. Copy the format your platform expects (colon hex or plain hex).
  4. For SAML, the SHA-256 fingerprint is the modern default; SHA-1 appears in older setups.

Frequently Asked Questions

Why do SAML setups ask for a certificate fingerprint? ▾

Instead of exchanging full certificates, many platforms identify trust by thumbprint — the SHA-1 or SHA-256 hash of the certificate’s DER encoding. Okta, OneLogin, and Shibboleth admin screens display them prominently. Two fingerprints match if and only if the certificates are byte-identical, so a typo-free thumbprint exchange proves you are trusting the exact right key.

Do these fingerprints match OpenSSL output? ▾

Yes. OpenSSL computes its fingerprint over the DER encoding of the certificate, which is exactly what this tool hashes with the browser’s Web Crypto digest. The colon-separated uppercase form matches openssl x509 -fingerprint; the lowercase plain hex matches what Java keytool and many cloud consoles display.