Encryption protects the conversation.
Fingerprints confirm who's in it.
Sealing a message to the wrong person protects it perfectly — for the wrong person. A key fingerprint is the two-minute check that closes that gap.
What a fingerprint is
Every Sharp#Soft identity has a public key, and every public key has a fingerprint — a short, human-readable digest shown in the Public Identity Viewer. Two people looking at the same identity see the same fingerprint; an impostor's identity — however convincing the name and picture — cannot produce it.
- The fingerprint is derived from the identity's key itself — it can't be chosen or forged to order
- It's public by design: showing it reveals nothing private
- It stays stable for the life of the identity — verify once, trust the channel after that
Why it matters
Encryption guarantees that only the holder of the matching key can open what you send. It cannot guarantee that the identity calling itself "Anna" is your Anna. Names and pictures are claims; the fingerprint is the fact.
The honest boundary: this check is only as good as the channel you verify over. Confirming a fingerprint through the same connection you're trying to verify proves nothing — use a channel you already trust.
How to verify — once, properly
- Open the Public Identity Viewer for the contact and find their key fingerprint
- Compare it over a separate channel you already trust — read it aloud on a phone call, compare in person, or use any channel the other person controls for sure
- Check that every group matches. Close is not equal — a lookalike fingerprint is exactly what an attack would produce
- Do it before the sensitive exchange, not after — see sharing and trust
For everyday conversations with people you've already verified, you never think about this again. The check is for the first contact, and for anything where being wrong is expensive.
Curious how identities work underneath?
"You're not an email address here" — the walkthrough explains the identity model step by step.