What a fingerprint is actually for

An SSH key fingerprint is a short, fixed-length hash of the public key's raw bytes — small enough to read aloud, compare visually, or paste into a ticket, unlike the full base64-encoded key itself. Its main practical use is verifying you're looking at the key you think you are: comparing the fingerprint shown by `ssh-keygen -lf` on a server against the one in your records before adding a new host to `known_hosts`, or confirming that the key a colleague pasted into a chat message matches the one actually deployed to `authorized_keys`, without having to diff the full multi-hundred-character key strings by eye.

SHA256 vs. MD5 — which one to use

SHA256 has been the default fingerprint format since OpenSSH 6.8 (2015) and is what modern `ssh-keygen -lf` and SSH client "host key verification" prompts show by default. MD5 fingerprints (the older, colon-separated hex format) still show up in legacy documentation, older tooling, and some third-party dashboards that haven't been updated — this tool computes both so a fingerprint from either era can be cross-checked without needing a separate command-line tool.

Because this only ever reads the public key half, there's no path by which a private key could be derived or exposed from anything pasted here — the public key format simply doesn't contain that information.