File Signature: Sign & Verify
Verify and create file signatures: OpenSSH ssh-keygen -Y, minisign and OpenSSL with Ed25519, ECDSA P-256/P-384 or RSA keys in PEM, OpenSSH or JWK format. Files and keys never leave your browser.
Your inputs and files stay in your browser
Verify a signature
Drop the file here
or choose a file from your device
An SSH signature (-----BEGIN SSH SIGNATURE-----), a .minisig file, or a raw signature as base64, hex or a binary .sig file.
PEM public key or certificate, OpenSSH .pub, authorized_keys or allowed_signers lines, JWK/JWKS, or a minisign public key.
SSH signatures only: the -n value of ssh-keygen (file, git, …).
OpenSSH, PEM (PKCS#8, encrypted PKCS#8, EC or RSA) or a JWK with "d". The key stays in this tab and is not saved.
Only for an encrypted key.
RSA padding applies to RSA keys, ECDSA encoding to ECDSA keys. Ed25519 signs the file itself (up to 128 MiB) and ignores the hash.
The verification result or the new signature appears here.
On this page
File Signature verifies and creates detached signatures for files of any size: OpenSSH signatures from ssh-keygen -Y, minisign .minisig files and raw OpenSSL signatures with Ed25519, ECDSA P-256/P-384 and RSA keys. The file is hashed in your browser in 1 MiB chunks; files, keys and passphrases are never uploaded.
Detailed Functionality
Verify checks a downloaded release, backup or document against its signature. Drop the file, paste the Signature or use Load signature file, and give the Public key. The format is detected automatically:
- OpenSSH signatures (
ssh-keygen -Y sign, also used for Git commits and tags): the key may be a.pubfile,authorized_keyslines or anallowed_signersfile — the matching line shows who signed, and itsnamespaces=limit is respected. The Namespace must match the one used when signing (usuallyfile). Without a key the tool still checks the signature against the key it carries and shows its fingerprint. - minisign
.minisig(prehashed BLAKE2b and legacy): the key ID and the trusted comment are checked, so a forged comment is reported. - Raw signatures from
openssl dgst -signoropenssl pkeyutl -rawin: binary, base64 or hex; ECDSA in DER or r‖s; RSA PKCS#1 v1.5 or PSS; SHA-256/384/512. Keys can be PEM (SPKI or PKCS#1), an X.509 certificate, an OpenSSH line or a JWK.
Sign creates a signature with your Private key: OpenSSH, PEM (PKCS#8, encrypted PKCS#8, EC or RSA) or a JWK, with a Passphrase for encrypted keys. Choose an SSH signature (ssh-keygen -Y) — readable by ssh-keygen -Y verify — or a Raw signature (OpenSSL) with a Hash, RSA padding and ECDSA encoding. The result shows the signature, the key fingerprint, the public key and a ready command to verify it with ssh-keygen or openssl.
Practical Examples
Check a release download: drop tool-1.4.tar.gz, load tool-1.4.tar.gz.sig and paste the project's allowed_signers — the result shows The signature is valid and the signer [email protected].
minisign: drop the archive, load its .minisig and paste the RW… public key from the project page; the trusted comment with the file name and timestamp is shown.
OpenSSL: verify openssl dgst -sha256 -sign key.pem -out data.sig data.bin with public.pem; the hash and padding are found automatically.
Sign for a colleague: load your id_ed25519, keep SSH signature (ssh-keygen -Y) and namespace file, click Sign file, then send the .sig with the allowed_signers line.
How to Use This Tool
Choose the file
Drop the file onto Drop the file here or click Choose file. Any size works: it is hashed in chunks.
Pick the mode
Select Verify to check a signature or Sign to create one.
Give the signature and keys
For Verify, paste the Signature and the Public key, and check the Namespace for SSH signatures. For Sign, paste the Private key, enter the Passphrase if it is encrypted and choose the Signature format.
Run
Click Verify signature or Sign file. Progress shows the bytes hashed; Cancel stops it.
Read the result
A green or red message gives the verdict, with the key fingerprint, scheme, hash and signer below. After signing, use Download .sig or copy the signature.
Tips and Best Practices
- A valid signature without a trusted key only proves integrity, not who signed: always compare the fingerprint or provide the signer's key.
gitsigns commits with namespacegit, plainssh-keygen -Y signusually withfile.- RSA-PSS signatures from OpenSSL are checked with both the digest-length and the maximum salt, so old and new OpenSSL versions verify.
- Ed25519 raw signatures sign the whole file, not a hash: they are limited to 128 MiB here, while SSH signatures have no size limit.
- The private key is used only in this tab and is not saved; still, prefer a dedicated signing key over your everyday SSH key.