HashKnownHosts

HashKnownHosts is a configuration option used by the OpenSSH client to control how host identifiers are stored in the user’s known_hosts file. When enabled, the client writes a hashed form of the host’s identifier instead of the plain hostname. The purpose is to protect privacy by making it harder for other local users to determine which hosts you have connected to, should they gain access to your known_hosts file. The hashing does not affect the verification of the host key during subsequent connections.

How it works in practice: with HashKnownHosts set to yes, new entries in known_hosts are written as hashes rather than readable host names. During a connection, the SSH client uses the same hashing process to match the server’s identity against the stored entries, allowing key verification to proceed as usual while concealing the actual hostnames from casual inspection. This applies to standard hostnames and, when present, address patterns included in the first field of known_hosts entries.

Security and usage considerations: hashing improves privacy on multi-user systems or shared workstations by reducing exposure of your connection history. However, it can make manual maintenance more difficult. If you need to identify, edit, or remove specific entries, you may rely on specialized tools or temporarily disable hashing. Some administrative tasks that rely on readable hostnames become harder once hashing is enabled.

Configuration: HashKnownHosts is an OpenSSH client option. It can be set in the global ssh_config or in a user’s ~/.ssh/config file with a line such as HashKnownHosts yes or HashKnownHosts no. The default value depends on the OpenSSH version and distribution.