diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index 9e05719ca..1735f92db 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -317,8 +317,8 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 		Followup:   url,
 	}
 	c.logf("RegisterReq: onode=%v node=%v fup=%v\n",
-		request.OldNodeKey.AbbrevString(),
-		request.NodeKey.AbbrevString(), url != "")
+		request.OldNodeKey.ShortString(),
+		request.NodeKey.ShortString(), url != "")
 	request.Auth.Oauth2Token = t
 	request.Auth.Provider = persist.Provider
 	request.Auth.LoginName = persist.LoginName
@@ -350,7 +350,7 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 			return true, "", fmt.Errorf("weird: regen=true but server says NodeKeyExpired: %v", request.NodeKey)
 		}
 		c.logf("server reports new node key %v has expired",
-			request.NodeKey.AbbrevString())
+			request.NodeKey.ShortString())
 		return true, "", nil
 	}
 	if persist.Provider == "" {
diff --git a/control/controlclient/netmap.go b/control/controlclient/netmap.go
index 7a5c36eea..a31cb8d22 100644
--- a/control/controlclient/netmap.go
+++ b/control/controlclient/netmap.go
@@ -63,19 +63,10 @@ func (nm NetworkMap) String() string {
 	return nm.Concise()
 }
 
-func keyString(key [32]byte) string {
-	b64 := base64.StdEncoding.EncodeToString(key[:])
-	abbrev := "invalid"
-	if len(b64) == 44 {
-		abbrev = b64[0:4] + "…" + b64[39:43]
-	}
-	return fmt.Sprintf("[%s]", abbrev)
-}
-
 func (nm *NetworkMap) Concise() string {
 	buf := new(strings.Builder)
 	fmt.Fprintf(buf, "netmap: self: %v auth=%v :%v %v\n",
-		keyString(nm.NodeKey), nm.MachineStatus,
+		nm.NodeKey.ShortString(), nm.MachineStatus,
 		nm.LocalPort, nm.Addresses)
 	for _, p := range nm.Peers {
 		aip := make([]string, len(p.AllowedIPs))
@@ -108,7 +99,7 @@ func (nm *NetworkMap) Concise() string {
 		// table to look good in that case. This will also make multi-
 		// subnet nodes stand out visually.
 		fmt.Fprintf(buf, " %v %-2v %-15v : %v\n",
-			keyString(p.Key), derp,
+			p.Key.ShortString(), derp,
 			strings.Join(aip, " "),
 			strings.Join(ep, " "))
 	}
@@ -277,7 +268,7 @@ func (nm *NetworkMap) _WireGuardConfig(uflags int, dnsOverride []wgcfg.IP, allEn
 
 	for i, peer := range nm.Peers {
 		if (uflags&UAllowSingleHosts) == 0 && len(peer.AllowedIPs) < 2 {
-			log.Printf("wgcfg: %v skipping a single-host peer.\n", peer.Key.AbbrevString())
+			log.Printf("wgcfg: %v skipping a single-host peer.\n", peer.Key.ShortString())
 			continue
 		}
 		if i > 0 {
@@ -311,16 +302,16 @@ func (nm *NetworkMap) _WireGuardConfig(uflags int, dnsOverride []wgcfg.IP, allEn
 			aip := allowedIP.String()
 			if allowedIP.Mask == 0 {
 				if (uflags & UAllowDefaultRoute) == 0 {
-					log.Printf("wgcfg: %v skipping default route\n", peer.Key.AbbrevString())
+					log.Printf("wgcfg: %v skipping default route\n", peer.Key.ShortString())
 					continue
 				}
 				if (uflags & UHackDefaultRoute) != 0 {
 					aip = "10.0.0.0/8"
-					log.Printf("wgcfg: %v converting default route => %v\n", peer.Key.AbbrevString(), aip)
+					log.Printf("wgcfg: %v converting default route => %v\n", peer.Key.ShortString(), aip)
 				}
 			} else if allowedIP.Mask < 32 {
 				if (uflags & UAllowSubnetRoutes) == 0 {
-					log.Printf("wgcfg: %v skipping subnet route\n", peer.Key.AbbrevString())
+					log.Printf("wgcfg: %v skipping subnet route\n", peer.Key.ShortString())
 					continue
 				}
 			}
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 00ecaa74e..f096d24cf 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -442,7 +442,7 @@ func (k *MachineKey) UnmarshalText(text []byte) error {
 
 func (k NodeKey) String() string { return fmt.Sprintf("nodekey:%x", k[:]) }
 
-func (k NodeKey) AbbrevString() string {
+func (k NodeKey) ShortString() string {
 	pk := wgcfg.Key(k)
 	return pk.ShortString()
 }