Certificate Fingerprint Checker

A cryptographic hash of the certificate's complete DER encoding. Because it covers every byte, any change anywhere produces a completely different fingerprint — which makes it a compact identifier for one exact certificate. Windows calls it the thumbprint; they are the same thing.

SHA-256. SHA-1 fingerprints are still shown by many tools and are fine as an identifier where you are only comparing two values you already trust, but SHA-1 has practical collision attacks and should not be relied on where an attacker could influence the input.

Verifying you have the certificate you think you have. It is how certificate pinning is configured, how a self-signed certificate is trusted out of band, how you confirm a certificate over the phone, and how monitoring notices that a certificate changed.

Because renewal produces a new certificate with new dates and a new serial number, so every byte-level hash changes — even if the key is identical. This is the trap in pinning a certificate fingerprint: every renewal breaks the pin. Pinning the public key instead survives renewal, as long as the key is reused.

No. The hash is always computed over the DER bytes, which is what the PEM base64 decodes to. So the same certificate gives the same fingerprint whether you paste PEM or supply DER — if two tools disagree, one of them hashed the wrong thing.

No, and it does not need to. It normalises both values — dropping colons, spaces and case — and compares them character by character. The value is in not doing that by eye across 64 hex characters, where a transposition is easy to miss.