Free tools Windows power users keep installed
One-click scans. No signup required.
The SSH warning means your client cannot match the server’s presented host key with a trusted key in its known-hosts database. On a first connection, that is expected: verify the displayed fingerprint through an independent channel, then type yes only if it matches. If SSH says the key has changed, stop and investigate before removing anything; a rebuild or key rotation is possible, but DNS spoofing or a man-in-the-middle attack is also possible.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide explains how to distinguish a new host from a changed host, verify fingerprints, inspect the correct known_hosts entry, repair a stale record, and configure automation without disabling protection against changed keys.
As an Amazon Associate I earn from qualifying purchases.
What the warning actually means
SSH authenticates a server with a host key. The server presents its public host key during the connection, and your SSH client compares that key with entries in its known-hosts sources. The default per-user files on OpenBSD are ~/.ssh/known_hosts and ~/.ssh/known_hosts2; other systems can select additional files with the UserKnownHostsFile setting.
If no matching entry exists, SSH cannot yet prove that the machine at the requested hostname and port is the machine you intended to reach. It prints the host name, key type, fingerprint, and a confirmation prompt. Accepting a verified key records it locally so future connections can detect a mismatch.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The wording is not a statement that the server is malicious. It is a statement that trust has not been established for this client, host, and port combination. The security decision is whether the fingerprint shown now is the fingerprint that the server administrator or provisioning system says should be there.
First connection: verify before you accept
For a genuinely new host, use this sequence rather than blindly answering the prompt:
- Record the exact endpoint. Note the hostname or IP address, the port, and the fingerprint shown by SSH. A non-default port creates a different known-hosts identity from the same name on port 22.
- Obtain an expected fingerprint independently. Use a trusted administrator, a cloud or hosting console, a machine-provisioning record, or another channel that does not depend on the untrusted connection you are testing. Ask for the fingerprint for the exact host key and port.
- Compare character for character. Check the key algorithm as well as the fingerprint. Do not accept a key merely because the hostname looks familiar or because a colleague says the server was recently created.
- Accept only a match. Type
yesat the SSH prompt only when the displayed and independently obtained fingerprints are identical. Any other response leaves the connection untrusted. - Confirm the local record. SSH writes the accepted key to the active user known-hosts file, subject to your
UserKnownHostsFileconfiguration. Later connections can then be checked automatically.
Why the fingerprint must come from another channel
During a first connection, the server itself is the party presenting the key. If an attacker can intercept the connection, that attacker can present a different key and a convincing hostname. A fingerprint copied from the same session does not provide independent evidence. A value shown in a protected management console, supplied by an administrator over a separately authenticated channel, or included in a trusted provisioning record is more useful because it does not rely on the connection currently being tested.
What to do when no one can provide a fingerprint
Do not turn the absence of a reference value into permission to accept. Pause the connection and obtain the value from the person or system responsible for the host. For disposable test machines, you can still establish trust, but the person who created the machine should first confirm its host-key fingerprint. The warning is doing its job when it prevents an unverified decision.
A changed-key warning is a different incident
SSH treats a known host that suddenly presents a different key more seriously than a host with no entry. The old key is evidence of what you previously trusted. A mismatch can have an innocent cause:
- The server was rebuilt or its operating system was reinstalled.
- The administrator deliberately rotated host keys.
- The hostname or IP address was reassigned to another machine.
- Your local known-hosts data is stale, duplicated, or associated with the wrong endpoint.
It can also indicate DNS spoofing, traffic interception, or a man-in-the-middle attack. Do not suppress the warning, delete the entry, or accept the replacement until the new fingerprint is independently verified for that host and port.
Safe response to a legitimate rebuild or rotation
- Stop the SSH client when it reports the mismatch.
- Confirm with the administrator or management system whether the machine was rebuilt, moved, or rotated its host keys.
- Obtain the new fingerprint independently and compare it with the value SSH reported.
- After the comparison succeeds, remove only the obsolete entry for the affected host and port.
- Reconnect and accept the verified replacement when prompted. The new key then becomes the reference for subsequent sessions.
When the explanation does not fit
If nobody authorized a rebuild, rotation, or address change, treat the mismatch as a security incident. Preserve the warning and its fingerprint, verify DNS and network paths through your normal security process, and have the host owner investigate before anyone changes the known-hosts database. A clean-looking replacement prompt is not proof that the replacement is safe.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Find the entry SSH is using
Use ssh-keygen to search known-hosts files instead of editing a large file by hand.
Default port
For a host reached on port 22, search by name:
ssh-keygen -F example.exampleThe -F operation searches known-hosts data and can find hashed host names or addresses. If you normally connect by an IP address, search for that address too; a name and an address can be separate entries.
Non-default port
For another port, include the bracketed host-and-port form:
ssh-keygen -F '[example.example]:2222'The brackets are significant. SSH stores a host with a non-default port as a combined host-and-port identity, so searching only for example.example can miss the relevant line.
Check which file and options are active
System-wide configuration can add files or change the defaults. Review the effective configuration for the exact destination before modifying anything:
ssh -G example.example | grep -i userknownhostsfileIf your connection uses an alias from ~/.ssh/config, run the command with that alias. Also check whether a command-line option, a system configuration file, or an automation wrapper supplies a different UserKnownHostsFile. Removing a line from an inactive file will not resolve the warning.
Remove one stale key, not the whole database
After the replacement fingerprint has been verified, remove the obsolete record with the supported removal workflow:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →ssh-keygen -R example.exampleFor a non-default port, identify the stored endpoint exactly:
ssh-keygen -R '[example.example]:2222'Use the same spelling SSH uses in its warning. If the warning names an IP address, remove the IP entry; if it names a bracketed host and port, use that form. The command updates the known-hosts file and normally saves a backup of the changed file. Keep that backup until the corrected connection has been verified.
Hashed host names
Many users enable hashing so that someone who obtains the file cannot easily read the host names. Hashed entries are difficult to recognize by eye, but ssh-keygen -F can search them and ssh-keygen -R can remove the matching host. This is safer than trying to identify a hashed line manually.
Multiple keys for one endpoint
A server can publish more than one host-key algorithm, and a known-hosts file can contain several keys for the same endpoint. Inspect every result from ssh-keygen -F. Remove only the key that was confirmed obsolete; do not erase valid entries simply because another key was rotated.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choosing a remediation method
The right action depends on whether the key is new or changed, whether the fingerprint was independently verified, which file is active, and whether a stronger pre-provisioned or DNS-backed trust source exists.
| Situation | Fingerprint independently verified? | Recommended action | Protection against changed keys |
|---|---|---|---|
| First connection to a new host | Yes | Accept the prompt and let SSH add the key | Preserved |
| First connection to a new host | No | Stop and obtain the expected fingerprint | Preserved |
| Known host presents a changed key after an authorized rebuild | Yes | Remove only the verified stale entry, then reconnect | Preserved |
| Known host presents a changed key with no authorized explanation | No | Do not alter known-hosts data; investigate the endpoint and network | Preserved |
| Automated first connection with pre-provisioned keys | Yes, before deployment | Install the expected key in the job’s active known-hosts file | Preserved |
| DNSSEC-protected SSHFP is correctly published | Validated through DNSSEC | Use DNS verification settings appropriate to your policy | Preserved when the key later changes unexpectedly |
StrictHostKeyChecking: what each setting does
The OpenBSD ssh_config(5) documentation describes ask as the default: new host keys are added only after confirmation, and SSH refuses hosts whose key has changed. That default is the safest interactive behavior for most users.
| Setting | New host key | Changed host key | Use case |
|---|---|---|---|
ask |
Prompts for confirmation | Refuses the connection | Normal interactive use |
accept-new |
Automatically adds the key | Does not permit the connection | Automation where first-use approval is acceptable but changed keys must fail |
yes |
Requires a pre-existing trusted key | Refuses the connection | Strict deployments with pre-provisioned known-hosts data |
no or off |
May add keys without an interactive confirmation | Can allow changed keys under documented restrictions | Not a safe general-purpose fix |
For a one-off automation test, accept-new can avoid an interactive prompt while still refusing a changed key:
ssh -o StrictHostKeyChecking=accept-new [email protected]That option does not verify a first-use key against an administrator’s fingerprint. If the first connection itself must be authenticated strongly, pre-provision the expected key and use StrictHostKeyChecking=yes instead.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Why disabling checking is dangerous
Setting StrictHostKeyChecking=no or off may make a failing script continue, but it weakens the control that detects a server substitution. It is not an appropriate response to a warning and should not be used as a universal workaround. Fix the trust data or the deployment process instead.
DNS verification with SSHFP
SSH can use SSHFP records through VerifyHostKeyDNS. With yes, a key can be implicitly trusted when it matches a secure SSHFP fingerprint. With ask, SSH displays the match while retaining normal confirmation behavior.
DNS is an independent verification source only when the SSHFP records are correctly published and protected by DNSSEC. An unsigned or improperly maintained record does not provide the same assurance. Confirm that the resolver and domain actually validate DNSSEC before relying on this method, and keep normal host-key refusal behavior for mismatches.
Graceful host-key rotation with UpdateHostKeys
UpdateHostKeys lets a trusted connection learn additional server keys so an administrator can rotate keys without an abrupt first-contact warning. The initial key must already be trusted or explicitly accepted. OpenSSH also requires the documented known-hosts conditions before it accepts replacement keys; enabling the option does not turn an unverified connection into a trusted one.
Recommended Free Tools
A practical rotation plan is:
- Publish the replacement key on the server while the currently trusted key is still active.
- Connect through an already trusted relationship with host-key updating enabled according to your client policy.
- Allow the client to record the additional key in the active known-hosts file.
- Retire the old server key only after clients have learned the replacement and your records show the expected fingerprint.
If a client reports a changed key instead of learning a planned replacement, stop and verify the fingerprint. Do not use host-key updating as a reason to ignore a mismatch.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common causes and precise fixes
The server was rebuilt
Reinstallation commonly generates new host keys. Ask the owner to confirm the rebuild and provide the new fingerprint. Then remove the old host-and-port entry with ssh-keygen -R and reconnect. Do not delete unrelated hosts from the file.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
An IP address was reassigned
Cloud and lab addresses can move between machines. A familiar IP does not prove that the current machine is the old machine. Verify the new owner and fingerprint, then replace only the address entry after authorization.
You are using the wrong port
A service moved from port 22 to another port can appear to have a new identity because SSH stores the port as part of the host key lookup. Search and remove the bracketed form, such as [example.example]:2222, and verify the key for that service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A DNS name now resolves differently
Multiple addresses, planned migrations, split DNS, or a malicious DNS response can produce different keys. Check the name resolution path and ask the service owner which addresses are valid. Do not accept whichever address answers first.
An alias points to a different destination
An entry in ~/.ssh/config can map a short alias to another hostname, port, or known-hosts file. Resolve the effective configuration with ssh -G alias, then search the actual host and port shown by that configuration.
A job runs under another account
Automation often uses a service account with a different home directory and therefore a different known_hosts file. Install or remove the key in the account and file used by the job, not only in your personal ~/.ssh directory. Log the effective destination and known-hosts path so future failures can be diagnosed without disabling checks.
A repeatable recovery checklist
- Copy the complete warning, including hostname, port, key type, and fingerprints.
- Determine whether the endpoint is new or previously trusted.
- For a new endpoint, obtain an expected fingerprint through an independent channel.
- For a changed endpoint, confirm an authorized rebuild, rotation, or address reassignment before changing local data.
- Search the active known-hosts sources with
ssh-keygen -F, using the bracketed port form when necessary. - Back up the relevant known-hosts file.
- After verification, remove only the stale host-and-port entry with
ssh-keygen -R. - Reconnect using the normal
askbehavior, or use a pre-provisioned key withStrictHostKeyChecking=yesin unattended environments. - Record the new fingerprint in the system’s provisioning or change-management record.
What not to do
- Do not type
yessolely because the connection is urgent. - Do not delete the entire
known_hostsfile to clear one warning; that removes evidence and trust records for every other host. - Do not disable host-key checking globally with
StrictHostKeyChecking=nooroff. - Do not treat a hostname, IP address, or familiar login banner as proof of identity.
- Do not replace a changed key until the new fingerprint has been checked independently.
Key points to remember
A first-connection warning asks you to establish trust; a changed-key warning asks you to investigate a possible identity change. Verify the fingerprint before either acceptance or replacement, search the exact host-and-port form in the active known-hosts file, and remove only the obsolete entry. For automation, pre-provision verified keys or use accept-new when your policy accepts unverified first use but requires changed keys to fail. Keep DNSSEC-backed SSHFP and UpdateHostKeys as complementary controls, not substitutes for verifying the initial trusted key.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
