fingerprint

a pgp fingerprint is a short hash of a public key - the one string you compare to prove a key is really theirs and not a scammer's upload.

a fingerprint is a cryptographic digest of a public key, displayed as forty hexadecimal characters (for the ubiquitous v4 keys) usually grouped in blocks of four. two keys produce the same fingerprint only if they are the same key - down to the last bit.

its job is solving the trust bootstrap: comparing a full public key block character by character is hopeless, so you compare the fingerprint instead. the workflow in this scene: get the fingerprint from a source separate from where the key came from - an old signed profile, a pinned forum post, a second site the vendor controls - and confirm they match before trusting anything signed or encrypted to that key.

scammers exploit skipped comparisons constantly. they attach their own key to forged messages, hoping you never notice the fingerprint differs from the real one pinned years ago. our fingerprint comparator exists precisely for this check: paste two keys or fingerprints and get a match verdict instantly.

fingerprints are case-insensitive and space-insensitive by convention, so spacing differences do not mean a mismatch - differing hex characters do. even one differing character means different keys, full stop.