PGP Verify File

Overview

Check a detached OpenPGP signature against the file it signs. Add the file, its .asc or .sig, and the signer's public key. You get the facts on separate lines: whether the signature is valid, which key made it, that key's status, the signing time the signer claims, and the digest used. If you don't have the right key, you get a warning with the key ID to look for, not a red failure. The check runs on your device with openpgp.js, and nothing is uploaded.

Checking a downloadCheck an installer or release archive against the .asc the project publishes, so you know it wasn't swapped on a mirror.
Confirming a documentCheck the signature on a contract or report, and see whether the signing key has been revoked since.
Following install instructionsRun the same check as gpg --verify on a machine without GnuPG.
Files you can't uploadVerify a confidential archive without sending it anywhere, since the file is read in your browser.
Finding an unknown signerCheck a signature you have no key for and see which key ID made it.

Guides

01 How to verify a signed file or software release

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_verify_file
Set: Security
Input: text
Output: —
Max file: 50MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Add the file and signature

Drop in the signed file and its .asc or .sig, in either order. If you mix them up, the tool swaps them and tells you.

Add the signer's public key

Keep it in this browser's keyring first, with PGP Import Keys. The signature is checked against every key kept there. Without it, the signature can't be checked.

Read the result

You get five lines: valid or not, which key signed, that key's status, the claimed signing time and the digest. The headline follows the worst one.

Frequently asked

What does verifying a file signature prove?

That the file hasn't changed by a single byte since it was signed, and that it was signed with the private key matching the public key you used. It doesn't prove who holds that key. For that, compare the fingerprint with the one the project publishes somewhere you already trust.

Why does it say the signature could not be checked?

None of your keys match the one that signed it. That's shown as a warning, not a failure, because nothing failed. The tool tells you which key ID it needs, so you know what to fetch.

Verification failed. What went wrong?

Either the file isn't the one that was signed (a cut-off download, a different build, a re-compressed archive), or a different key made the signature. One changed byte is enough, which is why the check is worth doing.

The signing key has expired. Does that invalidate the file?

No. A signature made while the key was valid stays valid, so the result still says valid and the expiry shows on its own line. Expiry only means you shouldn't encrypt anything new to that key.

Do I need the signer's private key?

No, and you should never have it. Checking a signature only needs the public key. The private key stays with the signer.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/