Browser 106

max 50MB

Inspector security/pgp-sign-file

PGP Sign File

Overview

Sign a file with your OpenPGP private key without leaving the browser, and get back a detached signature — a small .asc or .sig that sits next to the original while the original stays byte-for-byte unchanged. That is what release signatures, package signatures and published checksums use, because the thing people download must not be altered by the act of signing it. Cleartext and inline signatures are available too, for the cases where the signature should travel inside the content. openpgp.js does the work on the device: the file, your key and your passphrase are never uploaded, the unlocked key is confined to a worker that is destroyed when the operation ends, and the passphrase itself is never stored. The output is standard OpenPGP that gpg --verify accepts, so downstream users can check it with the tooling they already have. A valid signature proves the bytes have not changed and that the holder of a particular private key produced it — not who that holder is, which is what publishing a fingerprint is for.

Signing a software releaseSign a tarball or installer with your published key so downloaders can confirm the file they got is the file you built, not something substituted in transit or on a mirror.
Making a delivered document tamper-evidentAttach a detached signature to a contract or a report so the recipient can prove later which version was sent, without the signing changing the document itself.
Signing a dataset before sharing itResearchers and journalists sign source files before handing them over, so anyone downstream can confirm they are working from the unmodified original.
Package and supply-chain signingProduce the detached .asc that package managers and verification scripts expect alongside a published artefact, using a key you generated and control.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_sign_file
Set: Security
Input: text
Output: MIXED
Max file: 50MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop the file in

Any file type — an archive, an installer, a PDF, a dataset. It is read in your browser and never uploaded. If what you want to sign is text rather than a file, the box below the drop zone takes that instead.

Unlock your key

Pick your private key from this browser's keyring or paste it in, and enter its passphrase. The key is unlocked inside a worker that is destroyed when the operation ends, and the passphrase is never stored.

Take the signature

A detached signature is the usual answer for a file: it comes out as its own small .asc or .sig that you publish next to the original, which stays byte-for-byte unchanged. Cleartext and inline signatures are also available when the signature should travel inside the content itself.

Frequently asked

What does signing a file prove?

That the file has not changed by a single byte since it was signed, and that the signature was made with the private key matching a given public key. It does not prove who owns that key — that comes from checking the fingerprint against a source you already trust, which is why projects publish theirs.

Detached, cleartext or inline?

Detached for files, almost always: the signature is a separate small file and the original is untouched, which is what release checksums and package signatures do. Cleartext and inline both change the artefact people download, which is rarely what you want for a binary.

Can I sign any type of file?

Yes. Signing operates on bytes, so an executable, a zip, an image and a spreadsheet are all the same operation. The file itself is never modified — a detached signature is produced beside it.

How does someone verify what I signed?

They need your public key, the file, and the signature. From the command line that is gpg --verify signature.asc file; in a browser, the companion PGP Verify File page does the same check and reports the facts separately — valid or not, whose key, and whether that key is expired or revoked.

How large a file can I sign?

The file is read in your browser, so the ceiling is your device rather than a server quota. Documents and typical release archives are comfortable; a multi-gigabyte image is a job for desktop GnuPG.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools