OneTaskBy Tim King · Updated
Signature Verifier
RSA-PSS, PKCS#1 v1.5, ECDSA and Ed25519 Checks With PEM or JWK Keys
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Signature Verifier works
This signature verifier checks whether a signature was made over your message by the private key that matches a public key. Paste the message, the public key and the signature, pick the algorithm, and it reports valid or invalid using the browser's Web Crypto API. Nothing is uploaded.
How the signature verifier works
A digital signature is only valid for one exact message, one key and one algorithm. Change a byte of the
message, use a different key or pick the wrong padding and verification fails. The verifier accepts a
public key as PEM (BEGIN PUBLIC KEY or BEGIN RSA PUBLIC KEY), as an X.509 certificate or as a JWK.
Signatures can be hex or base64. ECDSA signatures from OpenSSL come DER-encoded, while Web Crypto and JWS
use raw r and s joined together, so DER signatures are converted automatically. RSA-PSS uses a salt the
length of the hash, which is what openssl dgst -sigopt rsa_pss_saltlen:digest produces. The message can
be text, hex or base64 when you need to verify binary data.
FAQ
How do I make a signature to test this with?
Sign a file with OpenSSL: openssl dgst -sha256 -sign key.pem -out sig.bin msg.txt, then base64 it with
base64 sig.bin. Paste the text of msg.txt as the message, the public key and the base64 signature, and
choose RSASSA-PKCS1-v1_5 SHA-256 for an RSA key or ECDSA SHA-256 for an EC key.
Why does a correct signature show as invalid?
The usual causes are a trailing newline in the message that the signer included, the wrong hash or padding, or an RSA-PSS salt length that differs from the hash length. Try the message as hex if line endings might differ, and confirm the algorithm with whoever produced the signature.
Can I verify a signature on a file?
Paste the file's contents if it is text. For binary files, convert them to hex or base64 first and pick
that message format. Very large files are better checked locally with openssl dgst -verify, which reads
from disk without a size limit.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
JWT Signature Verifier
Verify a JWT's signature with a secret, PEM key or JWKS.
PEM Inspector
Decode PEM and DER into a readable ASN.1 tree.
RSA Key Generator
RSA key pairs as PEM or JWK, made in your browser.
EC Key Generator
Elliptic curve and Ed25519 key pairs as PEM or JWK.
Checksum Verifier
Check several files against a SHA256SUMS list, like sha256sum -c.