ssh-keyscan

Collect server host keys for later inspection.

Before you run

Collected keys are NOT authenticated. Compare fingerprints with a trusted administrator or independent trusted source before adding anything to known_hosts. Never pipe unverified output straight into known_hosts. Scanning is not login and does not prove access. The redirection below overwrites hostkeys.txt if it exists.

Examples

Collect port 2222 host keys into a local file with a five-second timeout.

ssh-keyscan -T 5 -p 2222 server.example.com > hostkeys.txt

Print collected fingerprints; verify them independently before trusting.

ssh-keygen -lf hostkeys.txt

Options and examples

-p portCommon

Query the specified SSH port.

Example

ssh-keyscan -p 2222 server.example.com

-T timeoutCommon

Set the connection timeout in seconds.

Example

ssh-keyscan -T 5 server.example.com

-t typeCommon

Request specific host-key types, separated by commas.

Example

ssh-keyscan -t ed25519,rsa server.example.com

-4 / -6

Use IPv4 only or IPv6 only, respectively.

Example

ssh-keyscan -4 server.example.com

-f file

Read host names or addresses from a file, one per line.

Example

ssh-keyscan -f hosts.txt

-H

Hash host names in output. This does not authenticate the returned keys.

Example

ssh-keyscan -H server.example.com

-c

Request host certificates instead of plain host keys when supported.

Example

ssh-keyscan -c server.example.com

Authoritative references

Reviewed October 27, 2026