Fetch the SSH host keys offered by a server
Build a paste-ready command, then review its compatibility and effects before running it.
ssh-keyscan -H -p 22 <host>Complete required fields to copy the generated command.
Compatibility
Trust verification requiredssh-keyscan retrieves keys but does not authenticate them. Compare fingerprints through a trusted channel before adding them to known_hosts.
Operational knowledgereview due 2027-01-19
Requirementsssh-keyscanssh-keyscan must be installed and available on PATH.Network accessThe target must be reachable from the current environment.
Version supportssh-keyscan Current supported releasesVerified for linux, macos using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signals|1|pKj…Rk=|N4u…dE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9…Representative successful output; values vary with the selected target and system state.
Known errorsssh-keyscan: command not foundssh-keyscan is missing or is not available on PATH.
Verifyssh-keyscan -H -p {{port}} {{host}}The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01ssh-keyscanCommandRuns the ssh-keyscan stage of this one-liner.
02-HOptionHashes hostnames and addresses in the generated known_hosts lines.
03-pOptionConnects to the SSH service on the specified port.
04<port>ParameterA value supplied in the Fill parameters section.
05<host>ParameterA value supplied in the Fill parameters section.
Example input
ssh-keyscan -H -p 22 app01.example.com
Example output
|1|pKj…Rk=|N4u…dE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9…
|1|cT2…Qa=|W8x…nM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB…
Illustrative output — exact values vary by system and data.
Official sources
Related commands