Certificate Fingerprint Generator
Compute the SHA-1, SHA-256, SHA-384, and SHA-512 fingerprint (a.k.a. thumbprint) of an X.509 certificate’s DER-encoded bytes. Uses the browser’s built-in Web Crypto. Useful for matching a cert against pinned fingerprints, AAGUIDs, or audit lists.
Input
Result
What is a certificate fingerprint?
A "fingerprint" or "thumbprint" of an X.509 certificate is the hash of its DER-encoded bytes. SHA-256 is the modern default; SHA-1 is shown for compatibility with older systems but should not be used for new pinning. Always verify which algorithm a remote system expects.
Algorithms
SHA-1 (deprecated for security), SHA-256, SHA-384, SHA-512 — all from Web Crypto.
Certificate fingerprints and pinning
A certificate fingerprint is a cryptographic hash (SHA-256 or the legacy SHA-1) computed over the certificate's DER encoding. It gives you a short, unique identifier for a certificate — the value you compare when pinning, when confirming you uploaded the right cert, or when matching a certificate against an allow-list.
Prefer SHA-256: SHA-1 fingerprints are still shown by some tools but SHA-1 is deprecated for security use. Note that the fingerprint identifies the certificate, not the key — reissuing the same key in a new certificate changes the fingerprint, which is why key pinning and certificate pinning behave differently.
Frequently asked questions
SHA-1 or SHA-256 — which should I use?
SHA-256. SHA-1 is deprecated and collision-prone; only use a SHA-1 fingerprint when an older system explicitly requires it.
Why does my fingerprint not match the other tool's?
Usually because one hashes the DER certificate and another hashes the public key, or one uses SHA-1 and the other SHA-256. Compare like with like.
Is the certificate sent to a server to be hashed?
No. The hash is computed in your browser.
What exactly is being hashed to produce a fingerprint?
The complete DER encoding of the certificate, not the PEM text and not the public key alone. That is why the same certificate always produces the same fingerprint regardless of how it was stored.
What is certificate pinning and how does a fingerprint relate to it?
Pinning hard-codes an expected certificate or key so that any substitution is rejected even if signed by a trusted CA. Fingerprints are the value usually pinned, which is why they must be compared exactly.