SOURCE_URL: https://majikah.solutions/products/majik-message/docs/wiki-fingerprint

---
title: "Fingerprint & Public Address"
id: "wiki-fingerprint"
group: "majik-message"
type: "products"
version: "1.1.0"
lastUpdated: "2026-02-19T00:00:00.000Z"
difficulty: "Beginner"
time: "3-4 minutes"
tags: [fingerprint, public-address, identity, routing, sha-256, x25519, address, cryptography]
---

# Fingerprint & Public Address

> The unique cryptographic identifier derived from your public key — used for routing messages, verifying identity, and building thread integrity chains

## Overview
Every Majik Message account has a fingerprint: a 32-byte SHA-256 hash of its X25519 public key. The fingerprint uniquely identifies your account without revealing your private key or seed phrase. A shortened 2-byte version is displayed in the UI and used by the relay for routing. The full 32-byte fingerprint is embedded in every MJKB envelope and used to anchor the Thread integrity chain.

### What is a Fingerprint?

A fingerprint is a cryptographic identity token derived from your account's X25519 public key. It is calculated by running your X25519 public key through SHA-256, producing a 32-byte (256-bit) hash. This hash is unique to your account — no two accounts will produce the same fingerprint (the probability is astronomically small, approximately 1 in 2²⁵⁶). The fingerprint serves as your account's canonical identifier throughout the Majik Message system.

### Fingerprint vs. Public Address: Two Representations

The full fingerprint (32 bytes) is used internally: it is embedded in every MJKB envelope to identify the sender or intended recipient, and it anchors the SHA-256 integrity chain in persistent Threads. The public address (2 bytes) is what you see displayed in the Majik Message UI — a human-readable shorthand derived by truncating the full fingerprint. It is also what the relay server uses for message routing. The 2-byte address is not globally unique on its own, but in context — combined with the full MJKB envelope and encryption — it is sufficient for correct message delivery.

### Fingerprint Representations

| Form | Size | Where Used |
| --- | --- | --- |
| Full Fingerprint | 32 bytes (SHA-256 hash) | MJKB envelopes, Thread hash chain, internal routing |
| Public Address | 2 bytes (truncated fingerprint) | UI display, relay server routing |
| Invite Key | 1,184 bytes (ML-KEM-768 public key) | Adding contacts; contains full public key for encryption |

### How Fingerprints Are Used in MJKB Envelopes

Every MJKB envelope contains a fingerprint in bytes 1–32 of the binary structure. For a solo message, this is the recipient's fingerprint — so the relay knows which account to route the message to. For a group message, this is the sender's fingerprint — the per-recipient fingerprints are embedded inside the JSON payload's keys array, one entry per recipient. During decryption, Majik Message checks whether any fingerprint in the envelope matches one of the local seed phrase accounts, and if so, attempts decapsulation with the matching private key.

### What the Relay Can See

The Majikah relay only ever handles 2-byte truncated addresses for routing — not full fingerprints, not public keys, and certainly not private keys or message content. This means the relay cannot build a reliable social graph from routing metadata alone. Two-byte addresses are short enough to have collisions across the global user base, which is intentional — plausible deniability is built into the routing layer. Only the full MJKB envelope, combined with the private key of the intended recipient, can confirm the true destination of any message.

> **NOTE:** In persistent Threads, the sender's full fingerprint is included in each message payload before hashing. This means the hash chain not only verifies message content integrity but also cryptographically binds each message to its sender's identity. Tampering with the sender field breaks the chain.