A much safer implementation would be to take the sha256 of the key and only show the 2 rightmost bytes.