Host key checking is an SSH safeguard that verifies a server’s identity. During a first connection, the SSH client receives the server’s public host key and typically asks the user to trust it. The client then stores the key so it can compare it on later connections.
This check helps detect impersonation, including a man-in-the-middle attack in which an attacker presents a fake server. If a previously trusted key changes unexpectedly, SSH warns the user rather than silently accepting the new identity. Users should verify a first-time key through a trusted channel and investigate unexpected changes instead of ignoring warnings. Host key checking does not encrypt traffic by itself; it helps ensure the encrypted SSH session is established with the intended server.