Browser 106

no file limit

Inspector security/pgp-sign-message

PGP Sign Message

Overview

Sign a text message with your OpenPGP private key and produce output anyone holding your public key can check, including from the command line with gpg --verify. There are three shapes and the choice matters: a cleartext signature leaves the message readable with the signature appended below it, which is what an email or a forum post wants; an inline signature wraps message and signature into a single PGP block; a detached signature stands on its own and leaves the original text untouched. Signing is not encryption and does not hide anything — it answers who wrote this and has it changed since, not who can read it. Everything runs on openpgp.js in your browser, with the unlocked key confined to a worker that is destroyed when the operation ends; the passphrase is used and never stored, and nothing is uploaded. You can type the message here or drop a file if you would rather; the file-first version of the same operation is on the PGP Sign File page.

Signing a public statementAttach a cleartext signature to an announcement or disclosure so readers can confirm it came from the key they already associate with you, and that nobody edited it in the retelling.
Signing a release announcementMaintainers sign changelogs and version notes with their published key, so users can check the announcement before acting on a release.
Making a document tamper-evidentSign the text of a contract or an invoice so both parties can later verify the version they hold is the version that was agreed, character for character.
Proving you hold a keySign a challenge string someone gives you to demonstrate control of the private key behind a published fingerprint, without revealing the key or its passphrase.
Signing without GnuPG installedProduce a signed message on a machine with no PGP software, by pasting the key in and taking nothing away with you afterwards.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_sign_message
Set: Security
Input: text
Output: MIXED
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Write the message

Type or paste the text you want to sign. Signing does not hide anything — the message stays readable — so this is for the cases where it matters who wrote something, not whether anyone else can see it.

Unlock your key

Pick your private key from this browser's keyring or paste it in, and enter its passphrase. It is used for this signature and not stored; nothing is written to the device unless you have chosen to keep the key.

Choose the shape of the signature

Cleartext keeps the message legible with the signature appended below it, which is what you want for an email or a forum post. Inline wraps message and signature into one PGP block. Detached produces the signature on its own, leaving the original text untouched.

Frequently asked

What does a signature prove?

Two things: that the text has not changed by a single character since it was signed, and that the signature was made with the private key matching a given public key. It does not prove the key belongs to the person named on it — that is something you establish by checking the fingerprint through a channel you already trust.

Cleartext, inline or detached — which do I want?

Cleartext for anything a human will read, because the message stays legible with the signature underneath. Detached when the original must not change at all, such as a release file that people will download by itself. Inline when the message and its signature should travel as one opaque block.

Does signing hide the message?

No. Signing and encrypting are different operations answering different questions — signing says who wrote this and has it changed, encrypting says who can read it. A signed message is readable by anyone. If you need both, the encrypt routes can sign at the same time.

Can the recipient check this with GPG?

Yes. The output is standard OpenPGP, and the round trip has been checked against GnuPG: gpg --verify reports a good signature on output produced here, given your public key.

Is my private key safe while signing?

The key and its passphrase stay on the device and the tool makes no network requests. The unlocked key lives in a worker that is destroyed after any operation involving a passphrase, and the passphrase itself is never stored — not in the keyring, not anywhere.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools