PGP Sign File

Overview

Sign a file with your OpenPGP private key and get a detached signature: a small .asc or .sig that sits next to the original, which stays exactly as it was. That's how software releases and packages are usually signed. Cleartext and inline signatures are there too. Signing runs in your browser with openpgp.js, so your file, key and passphrase never leave your computer, and the passphrase is never stored. Anyone can check the result with gpg --verify.

Signing a software releaseSign an archive or installer so people can confirm they downloaded the file you built.
Sending a document you can vouch forAttach a signature to a contract or report so the recipient can later prove which version you sent.
Signing a dataset before sharing itSign source files before handing them over, so others can confirm they have the unchanged original.
Package signingMake the .asc file that package managers and verification scripts expect, with a key you control.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_sign_file
Set: Security
Input: text
Output: MIXED
Max file: 50MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Add the file

Drop in any file, or type text into the box below if that's what you want to sign.

Unlock your key

Pick your private key from this browser's keyring, then enter its passphrase. A key made elsewhere gets there through PGP Import Keys.

Get the signature

Download a small .asc or .sig to publish next to the original file, which stays unchanged.

Frequently asked

What does signing a file prove?

That the file hasn't changed by a single byte since it was signed, and that it was signed with the private key matching a given public key. It doesn't prove who owns the key. For that, people check your fingerprint against a source they trust.

Detached, cleartext or inline?

Detached, almost always. The signature is a separate small file and the original stays untouched, like release and package signatures. Cleartext and inline both change the file people download.

Can I sign any type of file?

Yes. Signing works on bytes, so a program, a zip, an image or a spreadsheet are all the same. The file itself is never changed.

How does someone verify what I signed?

They need your public key, the file and the signature. On the command line that's gpg --verify signature.asc file. In the browser, our PGP Verify File tool does the same check and shows whether the signature is valid, whose key made it, and whether that key has expired or been revoked.

How large a file can I sign?

The file is read in your browser, so your device sets the limit. Documents and typical release archives are fine. For files of several gigabytes, use GnuPG on your desktop.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/