Browser 106

max 50MB

Inspector security/pgp-verify-file

PGP Verify File

Overview

Check a detached OpenPGP signature against the file it covers, entirely in your browser. Because a detached signature is inherently two subjects, there are two inputs — the file and its .asc or .sig — and if you drop them the wrong way round the tool works that out and says so. Supply the signer's public key from this browser's keyring or by pasting it in, and you get five separate facts rather than one badge: whether the signature is cryptographically valid, which key made it, what state that key is in, when the signer claims it was signed, and which digest was used. The headline follows the worst of those, and it has three states, not two. A signature you hold no key for reads as could not be checked, in warning rather than red or green, because nothing has failed and there is simply nothing to check against — and you are told which key ID to go and find. A signature from an expired key still reads as valid, since it is, with the expiry on its own row. The signing time is labelled as asserted by the signer rather than proved, every time it is shown. openpgp.js does the checking on the device; the file, the signature and the key are never uploaded.

Verifying a software downloadCheck a release tarball or installer against the detached .asc the project publishes, so you know the file came from the maintainer's key and not from a compromised mirror.
Confirming a delivered documentValidate the signature on a contract or report from a counterparty, and see in the same view whether the key that signed it has since been revoked.
Following a project's verification instructionsRun the same check that gpg --verify would run, on a machine where GnuPG is not installed, against the .sig that shipped alongside the package.
Checking files you cannot uploadVerify a confidential archive without handing it to a remote service — the file is read in the browser and no network requests are made.
Tracking down an unknown signerVerify a signature you have no key for and learn which key ID produced it, instead of being shown a bare failure with nothing to act on.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_verify_file
Set: Security
Input: text
Output: —
Max file: 50MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop in the file and its signature

A detached signature is two things by definition, so there are two inputs: the file that was signed and the .asc or .sig that covers it. Drop them in either order — if what you gave first turns out to be the signature, the roles are swapped and you are told.

Provide the signer's public key

Pick it from this browser's keyring or paste it in. Without a matching key the signature cannot be checked, and that outcome is reported as itself rather than dressed up as a failure.

Read the rows

Five facts, each on its own line: is the signature cryptographically valid, which key made it, what state that key is in, when the signer claims it was signed, and which digest was used. The headline follows the worst of them.

Frequently asked

What does verifying a file signature prove?

That the file has not changed by a single byte since it was signed, and that the signature was made with the private key matching the public key you checked it against. It does not prove who holds that key — for that, compare its fingerprint with the one the project publishes, over a channel you already trust.

Why does it say the signature could not be checked?

Because no key you supplied or hold matches the one that made it. That is a third outcome, shown as a warning rather than red or green: nothing failed, there is simply nothing to check the signature against. You are told which key ID it is looking for, so you know what to go and fetch.

Verification failed. What went wrong?

Either the file is not the one that was signed — a truncated download, a different build, a re-compressed archive — or the signature was made by a different key than the one you checked against. A single flipped byte is enough, which is exactly what makes the check worth running.

The signing key has expired. Does that invalidate the file?

No. A signature made while the key was valid stays valid afterwards, so the headline still reads as valid and the expiry is reported on its own row. What expiry means is that you should not encrypt anything new to that key — not that its old signatures stopped being true.

Do I need the signer's private key?

No, and you should never have it. Verification only ever needs the public key. The private key is what made the signature and stays with the signer; anyone able to hand you one has given away the thing the signature depends on.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools