PGP Handtekening Verifiëren

Overview

Check an OpenPGP signature and see five facts instead of one green tick: is it valid, which key made it, is that key held, expired or revoked, when the signer says it was signed, and which digest was used. If you don't have the signer's key, it says the signature couldn't be checked rather than calling it a failure. It runs on openpgp.js in your browser, and nothing is uploaded.

Signed announcementsCheck a signed security advisory or release note against the project's key before you act on it.
Messages from a contactVerify an email against the key you hold for that person, and see if their key was revoked since.
Spotting changesOne changed character breaks the signature, so you know the text is exactly what was signed.
Unknown signersSee which key ID made a signature you have no key for, so you know what to look for.
Learning how signatures workSign something, change a character and verify again to see how invalid, unchecked and valid-but-expired differ.

Set

Beveiligingstools 26

Neighbours

01 AES Bestand & Tekst Encryptor 02 Base64 Decoderen 03 Base64 Coderen 04 CSR Generator 05 DER naar PEM Converter 06 Hash Generator

Specification

Command: security.pgp_verify_signature
Set: Security
Input: text
Output: —
Max. bestand: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Zoeken: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the signed message

A cleartext-signed message carries its own signature; for a detached signature, paste it into the second box.

Add the signer's public key

Keep it in this browser's keyring first, with PGP Import Keys. The signature is checked against every key kept there. If no key matches, you're told it couldn't be checked, which isn't a failure.

Read the rows

You get five facts (validity, signing key, key status, signing time, digest), and the headline follows the worst of them.

Frequently asked

What does a valid signature actually tell me?

That the message hasn't changed by a single character, and that it was signed with the private key matching the public key you used. It doesn't tell you who owns that key. Check the fingerprint against a source you already trust, because the name in a user ID is just text someone typed.

Why does it say the signature could not be checked?

No key you provided or hold matches the one that made it. Nothing has failed, so it shows as a warning, not red or green. Import the signer's public key and try again.

The signing key is expired. Is the signature bad?

No. An expired key still verifies signatures it made while it was valid, so the headline still says valid. Expiry gets its own row because it means something else: don't encrypt anything new to that key. A revoked key is shown the same way, with the reason.

Is the signing time proof of when it was signed?

No, and the tool says so next to the date. The signer writes the timestamp, so it's only as trustworthy as they are. PGP has no provable time; for that you need a timestamping authority.

Why did verification fail?

Either the message changed after signing, even by one space, or the signature wasn't made by the key you checked it against. Copy-paste is a common cause, because mail clients rewrap lines.

Keys

Zoeken: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/