PGP fingerprint.
The 40-character hexadecimal string that uniquely identifies an OpenPGP key. It's derived from the key itself, not assigned externally — so it's stable, collision-resistant, and the safe way to refer to a key when verifying identity.
A PGP fingerprint is a cryptographic hash of an OpenPGP public key, rendered as 40 hexadecimal characters. It's the canonical way to identify a key — when you publish "your PGP key", what you actually publish is your fingerprint, because it can't be forged without finding a hash collision.
What it is.
OpenPGP keys, the actual binary blobs containing public exponents or curve points, are large and unwieldy. A fingerprint is a fixed-size summary: take the key's binary representation, hash it (SHA-1 for v4 keys; SHA-256 for v6), and you get a 160-bit or 256-bit number. Display it as hexadecimal and you have something humans can read aloud or compare on a screen.
Critically, the fingerprint is derived from the key. There's no central registry handing out fingerprints; you don't pick yours. Generate a different key and you get a different fingerprint. Modify a key (add a User ID, sign it, add a subkey) and the fingerprint of the affected primary stays the same — because it's derived from the primary key's material, not from the additions.
Why it matters.
The fingerprint is what you verify when you check that a key really belongs to who it claims to. Names and emails on a key can be anything (anyone can put your email on a key they generated). The fingerprint can't be — without colliding the underlying hash, which is computationally infeasible for any modern PGP key.
When you publish "my PGP key", what you actually publish is your fingerprint. When a correspondent verifies your identity, they verify your fingerprint. When a maintainer rotates keys, the transition statement names old and new fingerprints. Everything identity-related in OpenPGP ultimately reduces to fingerprints.
40 hex characters, conventionally displayed as ten groups of four with a wider gap in the
middle for readability. Same fingerprint, no spaces: AAAABBBBCCCCDDDDEEEEFFFF11112222 33334444.
Related terms
Related guides
Get PGPony
Free OpenPGP encryption for iOS and Android. No accounts, no tracking.