PGP Signature Sign & Verify
Check that a download comes from its publisher, or sign files and text with your PGP key.
Try before you buy.
- Free preview: the verdict of every signature and the signed text in full, with the signer’s details and the first lines of a new signature shown in part.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
What to check
Result
Choose what to check, then press Check signature.
The signed text
The same with GnuPG
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the PGP Signature Sign & Verify
Many projects sign their releases with OpenPGP: next to release.tar.gz you find release.tar.gz.asc (or .sig) and the publisher’s public key. Drop the three here and the page checks the detached signature against the file — the file is read as a stream, so large downloads work — and tells you whether the signature is good, which key made it (user ID, fingerprint, signing subkey), when, and with which algorithm. It also checks cleartext signed messages (-----BEGIN PGP SIGNED MESSAGE-----, as gpg --clearsign writes them) and signed messages (gpg --sign), and shows exactly which text a cleartext signature covers.
To sign, paste your private key and its passphrase and choose a cleartext signature for text or a detached signature for a file or text, armored (.asc) or binary (.sig). The work is done by OpenPGP.js in a background worker; in our tests GnuPG 2.5.22 verified the signatures made here, and the page reads GnuPG’s. Nothing is uploaded.
Without a pass you see a free preview: the verdict of every signature and the signed text, with the signer’s details and the first lines of a new signature shown in part. The whole report and signature, and copying or downloading them, unlock with a Pro pass.
How to use it
- Choose Verify or Sign.
- Verify a download: drop (or choose) the file, its
.ascor.sigsignature and the publisher’s public key together — the page sorts them — or paste a cleartext signed message and the signer’s key (Example signed message fills in one to try). - Read the verdict, then compare the fingerprint with the one the publisher lists on their HTTPS site or announcement: that is what makes the key trustworthy.
- Sign: paste your private key (or open it) and its passphrase, choose cleartext or detached, then type the text or choose the file and press Sign. With a pass or after unlocking this result, download the signature next to the file.
Examples
release-1.2.3.bin · release-1.2.3.bin.asc · the publisher’s key (BEGIN PGP PUBLIC KEY BLOCK)
Good signature · signed by “Release Fixture <release-fixture@example.com>” · fingerprint 0313 1462 FA50 4218 71A5 0A0C 0D4B CFCE 32A5 AFF2 · EdDSA with SHA-512
The same release with one byte different
Bad signature: it does not match the data — do not use the file
-----BEGIN PGP SIGNED MESSAGE----- … (gpg --clearsign) and the author’s key
Good signature, with the exact text that it covers shown on its own
Common uses
- Checking software releases, ISO images and firmware against the developer’s signature before installing them.
- Checking signed security advisories, checksum files (SHA256SUMS.asc) and announcements.
- Signing your own releases, checksum files or messages so others can check they came from you.
- Testing an OpenPGP setup: does a signature made with one tool verify in another.
Cleartext or detached?
- Cleartext (RFC 9580 §7) keeps the text readable around the signature, for e-mail, announcements and checksum lists. Trailing spaces are not signed and line endings count as CRLF, so it is unsuitable for files where spacing matters (RFC 9580 §7.3 names diffs).
- Detached (RFC 9580 §10.4) is a separate small file over the exact bytes of any file — the right choice for releases. Armored
.ascis text; binary.sigis smaller. Both are whatgpg --armor --detach-signandgpg --detach-signmake.
When you check a cleartext message, only the part between the BEGIN PGP SIGNED MESSAGE header and the signature is covered; the page says so when there is other text around it.
What a good signature does — and does not — prove
A good signature proves the data was signed with the private key that belongs to the public key you used, and has not changed since. It does not prove that key belongs to the publisher: anyone can make a key with any name. Get the publisher’s fingerprint from a source you trust — their HTTPS website, a release announcement, a colleague — and compare it with the one shown. This is what GnuPG means by “This key is not certified with a trusted signature”.
A signature by a key that has since expired or been revoked is reported with the key’s status; a revoked key must not be trusted.
The same with GnuPG
- Check a file:
gpg --import publisher-key.asc, thengpg --verify release.tar.gz.asc release.tar.gz - Check a cleartext message:
gpg --verify message.txt.asc - Sign:
gpg --armor --detach-sign file,gpg --detach-sign fileorgpg --clearsign message.txt
Open-source software used
Signatures are made and checked with OpenPGP.js, licensed under the GNU Lesser General Public License v3.0 or later. It is loaded as its own, unmodified file — licence header included — and runs in a background worker.
Limitations
- Signing reads the file into memory (up to 256 MB); checking a detached signature reads the file as a stream.
- Keys can be armored or binary; smartcard and security-key (YubiKey) keys cannot sign here, because their private key never leaves the device.
- Encrypted messages are not opened here: use PGP Encrypt / Decrypt, which also checks the signature inside.
- Web of Trust and key servers are not consulted: you decide whether to trust the key, by its fingerprint.
Privacy
On this device: nothing is sent
Your keys, passphrase, files and messages are handled only by OpenPGP.js in a background worker in this tab. Nothing is uploaded, logged or stored; OpenPGP.js itself is a file of this site, loaded once. The example key is a throwaway key made in this tab: never use it for anything real.
Frequently asked questions
What do I get without a pass?
Without a pass, PGP Signature Sign & Verify shows the verdict of every signature and the signed text in full, with the signer’s details and the first lines of a new signature shown in part. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
How do I check a downloaded file’s .asc signature?
Download the publisher’s public key from their website, then drop the file, the .asc and the key here together. “Good signature” means the file is exactly what the key’s owner signed; compare the fingerprint with the one the publisher lists to be sure the key is theirs.
The page says the signature is by a key I did not give. What now?
The signature names the signer’s key ID. Get the public key with that ID from the publisher (often linked as “signing key” or published in a KEYS file) and add it. A signature by an unknown key proves nothing either way.
Why is my cleartext signature bad after I copied it?
Cleartext signatures cover the text exactly, apart from trailing spaces and line-ending style. Mail programs and editors that rewrap lines, change quotes or add text inside the signed part break it. For files, use a detached signature instead.
Is it safe to use my private key here?
The key is decrypted and used only in your browser, by OpenPGP.js in a background worker, and nothing is sent anywhere. For a key that protects very valuable releases, many projects sign on an offline computer; the signatures are the same either way.
Open-source components
This page can load these open-source components, each only when a task needs it:
- It uses OpenPGP.js under the LGPL v3: licence and source code.
You may replace them with your own builds. Their licences and the credits of every library the site uses are on the open-source credits page.