SSH: hash known hosts

15 Jun, 2025 • 106 words • 1 min • updated 18 Jan, 2026

⚠️ This post is over one year old. It may no longer be up to date or relevant. Opinions may have changed.

A security / privacy tip: hash ssh hosts, especially in machines you have access to that are in the cloud. ~/.ssh/config:

Host *
	# Automatically hash new host keys added to ~/.ssh/known_hosts.
	# Manually for pre-existing hosts: ssh-keygen -H
	HashKnownHosts yes

The default is not to hash.

As a side effect, ~/.ssh/known_hosts (sample entry):

|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= sh-ed25519 [...]

The only change is that if a machine is compromised, the idea is to minimize how much usable information is given to an attacker.

To retroactively hash existing entries, run:

     shell
     
   
% ssh-keygen -H
/Users/tperrotta/.ssh/known_hosts updated.
Original contents retained as /Users/tperrotta/.ssh/known_hosts.old