Digital Signature Sign & Verify

About the Digital Signature Sign & Verify

Sign a text or a file with your private key, or check that a signature was made by the holder of a public key over exactly the data you have — the job behind API request signing, signed webhooks, release files and licence keys. The page supports RSA-PSS and RSASSA-PKCS1-v1_5 (RFC 8017) with SHA-256, SHA-384 or SHA-512, ECDSA on P-256, P-384 and P-521 in both encodings — DER, as OpenSSL, Java and .NET write it, and raw r‖s, as Web Crypto and JWS use it — and Ed25519 (RFC 8032). Keys can be PEM, JWK, a certificate or an OpenSSH public key.

When a check fails, the page tells you why: RSA signatures are opened with the public key to read the hash they name and the PSS salt length they use; other encodings and hashes are tried; and a text that differs only by a final line break or by CRLF line endings is recognised. Your browser’s Web Crypto signs and verifies; nothing is uploaded.

Without a pass you see a free preview: every verdict in full with the first findings of a check, and the start of each line of a new signature. The whole report and signature, and copying or downloading them, unlock with a Pro pass.

Common uses

• Checking a downloaded release, firmware or licence file against the publisher’s signature and public key.
• Debugging API request signing between a client and a server (wrong hash, wrong PSS salt length, DER versus raw ECDSA, an extra newline).
• Making test signatures for a verifier you are writing, with any scheme, hash and encoding.
• Converting an ECDSA signature’s meaning between OpenSSL (DER) and JWS / Web Crypto (raw r‖s) by checking it in both.

Which algorithm?

• RSA-PSS — RFC 8017 requires it for new applications (“in the interest of increased robustness”); randomized, with a salt. JOSE’s PS256 uses SHA-256 with a 32-byte salt (RFC 7518 §3.5).
• RSASSA-PKCS1-v1_5 — the older, deterministic RSA signature, still the most widely deployed (RS256, most X.509 certificates). No attack on it is known, but RFC 8017 keeps it for compatibility.
• ECDSA — small and fast; use the hash that matches the curve (SHA-256 with P-256, SHA-384 with P-384, SHA-512 with P-521, as ES256, ES384 and ES512 do).
• Ed25519 — fast, with no settings to get wrong, and deterministic by RFC 8032: the same key and data give the same signature (Safari’s Web Crypto adds randomness to each one, and they still verify everywhere); the default for new SSH keys. Browsers support it in Web Crypto from Chrome and Edge 137, Firefox 129 and Safari 17.

SHA-1 is offered only for checking old signatures: NIST SP 800-131A Rev. 2 disallows it for new signatures and allows verification only for legacy use.

Why a valid signature fails, and how the page finds out

• The wrong hash or the wrong RSA scheme: an RSA signature opened with the public key shows a PKCS #1 v1.5 DigestInfo (which names its hash) or the PSS structure, so the page can name the scheme and hash that were used.
• The PSS salt length: OpenSSL signs with rsa_pss_saltlen:max (222 bytes for a 2048-bit key with SHA-256) if asked, JOSE uses the hash length, and Web Crypto needs the exact number to verify. The page reads it from the signature (RFC 8017 §9.1.2).
• DER versus raw ECDSA: OpenSSL, Java and .NET write DER (about 70–72 bytes for P-256); Web Crypto and JWS use 64 raw bytes. Both are tried.
• Different bytes: the signer signed text with a final newline (as echo adds), with CRLF line endings, or the file was changed. A missing or extra final line break and swapped line endings are tried for typed text.
• Another key: if nothing fits, the signature was made with a different private key — check that you have the signer’s current public key.

The same with OpenSSL

• Sign: openssl dgst -sha256 -sign private.pem -out file.sig file (add -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:digest for RSA-PSS)
• Verify: openssl dgst -sha256 -verify public.pem -signature file.sig file
• Ed25519: openssl pkeyutl -sign -inkey private.pem -rawin -in file -out file.sig, and openssl pkeyutl -verify -pubin -inkey public.pem -rawin -in file -sigfile file.sig
• A Base64 signature to binary: openssl base64 -d -A -in file.sig.b64 -out file.sig

The page shows these commands with your settings after each run.

Limitations

• Files are read into memory: up to 256 MB, depending on the device.
• Ed448, secp256k1 and DSA signatures are not supported (browsers’ Web Crypto lacks them); Ed25519 needs a current browser.
• RSA-PSS uses MGF1 with the same hash as the message, as JOSE, Web Crypto and OpenSSL do by default.
• This page checks the signature, not whether the key belongs to who you think: compare the public key or its fingerprint with one you got over a channel you trust. For OpenPGP signatures (.asc), use PGP Signature Sign & Verify.

Privacy

On this device: nothing is sent

Your keys, data and signatures stay in this tab: your browser’s Web Crypto signs and verifies, and the checks of a failed signature use only the public key. Nothing is uploaded, logged or stored. The example keys come from RFC 7515 and RFC 8037, whose private keys are published; never sign anything real with them.