>_devtools

Sign & Verify Text (RSA, ECDSA, Ed25519)

Sign text with an RSA, ECDSA, or Ed25519 private key and verify signatures with a public key or certificate. Keys can be PEM or JWK and never leave your browser.

What this does

Signs a piece of text with a private key, or checks a signature against a public key. The algorithm follows the key you give it: RSA keys use RSASSA-PKCS1-v1_5 or RSA-PSS, EC keys use ECDSA, and Ed25519 keys use EdDSA. Keys can be PEM (PKCS#8, PKCS#1, SEC1, SPKI) or JWK, and for verification a certificate works too. The text is signed as UTF-8 bytes, exactly as typed.

Matching other tools

  • OpenSSL: openssl dgst -sha256 -sign key.pem msg.txt produces an RSA PKCS#1 v1.5 or ECDSA signature that verifies here when the file holds the same bytes (watch for a trailing newline). ECDSA from OpenSSL is ASN.1 DER, which is this tool's default.
  • JWT and JOSE: ES256, ES384, and ES512 signatures use the raw r||s form. Pick "Raw r||s" and Base64URL to match.
  • RSA-PSS: the salt length equals the hash length, the common default for PS256 and friends.
  • Hash: "Default for the key" means SHA-256 for RSA and P-256, SHA-384 for P-384, and SHA-512 for P-521.

Verifying

A valid result means the signature was produced over exactly this message with the private key that matches the public key, using the selected scheme and hash. Anything else (a changed character, the wrong hash, a PSS signature checked as PKCS#1) gives "does not match", because that is all a signature check can tell you. Signature and ECDSA formats can be auto-detected.

Limits and privacy

Messages are limited to about 5 MB. Encrypted private keys are not decrypted; decrypt them with OpenSSL first. Private keys stay in this tab's memory only. They are never uploaded, saved, or placed in the URL, and the key box is not remembered when you leave. Use thekey pair generator to make a throwaway key for testing.