PGP Sign Message

Overview

Sign a message with your OpenPGP private key so anyone with your public key can check it, including with gpg --verify. Choose cleartext (the message stays readable, good for email or forums), inline (one PGP block) or detached (the signature on its own). Signing doesn't hide the text. It proves who wrote it and that it hasn't changed. Everything runs in your browser with openpgp.js, your passphrase is never stored, and nothing is uploaded. To sign a file instead, use PGP Sign File.

Signing a public statementAdd a cleartext signature to an announcement so readers know it came from your key and wasn't edited.
Signing release notesSign a changelog with your published key so users can check it before they update.
Tamper-evident documentsSign the text of a contract or invoice so both sides can later check they hold the agreed version.
Proving you hold a keySign a challenge string to show you control the private key behind a fingerprint, without revealing the key.
Signing without GnuPGSign a message on a machine with no PGP software. Import your protected key, sign, then remove the key from this browser.

Guides

01 How to generate a PGP key pair

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_sign_message
Set: Security
Input: text
Output: MIXED
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Write the message

Type or paste the text to sign. Signing doesn't hide it: it shows who wrote it, not who can read it.

Unlock your key

Pick your private key from this browser's keyring, then enter the passphrase, which is used once and never stored. A key made elsewhere gets there through PGP Import Keys.

Pick a signature type

Cleartext keeps the message readable with the signature below. Inline wraps both in one PGP block. Detached gives you the signature on its own.

Frequently asked

What does a signature prove?

That the text hasn't changed by a single character since it was signed, and that it was signed with the private key matching a given public key. It doesn't prove who owns the key. For that, check the fingerprint somewhere you already trust.

Cleartext, inline or detached: which do I want?

Cleartext for anything people will read, since the message stays readable. Detached when the original must stay exactly as it is, like a release file. Inline when message and signature should travel as one block.

Does signing hide the message?

No. Signing shows who wrote something and whether it changed. Encrypting decides who can read it. If you need both, the encrypt tools can sign at the same time.

Can the recipient check this with GPG?

Yes. The output is standard OpenPGP, and gpg --verify reports a good signature on it, given your public key.

Is my private key safe while signing?

Your key and passphrase stay on your device, and the tool makes no network requests. The unlocked key lives in a worker that is thrown away after any step that uses a passphrase. The passphrase is never stored anywhere.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/