Verification failed but I am sure the key is right.

Then the message differs from what was signed. Check for a trailing newline, converted line endings, or an editor that reflowed the text. Also confirm the hash matches the one used when signing — SHA-256 and SHA-384 produce entirely different results from the same key.

What does a valid signature actually prove?

That whoever holds the private key signed exactly this text, and that the text has not changed since. It proves nothing about who that person is. Identity comes from a certificate or a fingerprint you obtained through a channel you already trusted.

Does my private key leave this page?

It does not. The key is imported into your browser's cryptography engine and used there for the single operation. Nothing is transmitted or retained, and closing the tab discards it entirely.

Can I verify something signed by GPG or OpenSSL here?

Only if it used plain RSASSA-PKCS1-v1_5 over the raw message with a matching hash. GPG wraps signatures in its own packet format, so its output will not verify here. OpenSSL's raw signature output generally will.

Sign & Verify Text

Prove a message came from your key, or check that someone else's did.

Everything runs inside your browser. Your files never leave your device.

Input

Result

The result appears here as you type.

Ask about Sign & Verify Text

Questions about what this tool does, which option to pick, or what it can and cannot handle.

The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong. The tool itself is not guessing: it runs deterministic code on your device.

About the Sign & Verify Text

A digital signature answers a narrow question exactly. Given some text, a signature and a public key, it tells you whether the holder of the matching private key signed that precise text. Not similar text. Not the same text with a trailing newline. That one.

Signing takes your private key and produces a signature over the message. Verifying takes the corresponding public key, the message and the signature, and returns a yes or a no. This page does both, using RSASSA-PKCS1-v1_5 through your browser's cryptography engine, with the keys in the PEM format nearly every tool reads and writes.

Its practical use is provenance where a channel cannot be trusted. Publishing a release note that readers can confirm came from you. Signing a message in a forum where accounts can be impersonated. Checking a statement someone else signed against the public key they published elsewhere. In each case the signature carries the assurance rather than the medium.

The exactness is where people get caught. A single altered character, a converted line ending, an editor that trims trailing whitespace on save — any of these makes verification fail, correctly. That sensitivity is the whole mechanism, not a defect in it, and it is why signed text should be transported as a fixed block rather than pasted through anything that might reformat it.

One limit stated plainly: a valid signature proves control of a private key, and nothing about whose key it is. Binding a key to a person or an organisation requires something outside the mathematics — a certificate authority, a fingerprint published somewhere you already trust, or a key you were handed in person.

How to use it

1Paste the message into the input, exactly as it will be published or exactly as you received it.
2Choose whether you are signing or verifying, then paste the matching PEM key — private to sign, public to verify.
3When verifying, also paste the signature you were given.
4Set the hash to whatever was used to sign. SHA-256 is the usual choice, and a mismatch here fails verification just as a wrong key would.

Questions

Verification failed but I am sure the key is right.: Then the message differs from what was signed. Check for a trailing newline, converted line endings, or an editor that reflowed the text. Also confirm the hash matches the one used when signing — SHA-256 and SHA-384 produce entirely different results from the same key.
What does a valid signature actually prove?: That whoever holds the private key signed exactly this text, and that the text has not changed since. It proves nothing about who that person is. Identity comes from a certificate or a fingerprint you obtained through a channel you already trusted.
Does my private key leave this page?: It does not. The key is imported into your browser's cryptography engine and used there for the single operation. Nothing is transmitted or retained, and closing the tab discards it entirely.
Can I verify something signed by GPG or OpenSSL here?: Only if it used plain RSASSA-PKCS1-v1_5 over the raw message with a matching hash. GPG wraps signatures in its own packet format, so its output will not verify here. OpenSSL's raw signature output generally will.