指纹 (fingerprint)

pgp 指纹是公钥的短哈希 - 你拿来比对的那唯一一串字符,证明这把钥匙真的是本人的,而不是骗子上传的。

a fingerprint is a cryptographic digest of a public key, displayed as forty hexadecimal characters (for the ubiquitous v4 keys) usually grouped in blocks of four. two keys produce the same fingerprint only if they are the same key - down to the last bit.

its job is solving the trust bootstrap: comparing a full public key block character by character is hopeless, so you compare the fingerprint instead. the workflow in this scene: get the fingerprint from a source separate from where the key came from - an old signed profile, a pinned forum post, a second site the vendor controls - and confirm they match before trusting anything signed or encrypted to that key.

scammers exploit skipped comparisons constantly. they attach their own key to forged messages, hoping you never notice the fingerprint differs from the real one pinned years ago. our fingerprint comparator exists precisely for this check: paste two keys or fingerprints and get a match verdict instantly.

fingerprints are case-insensitive and space-insensitive by convention, so spacing differences do not mean a mismatch - differing hex characters do. even one differing character means different keys, full stop.