Browser 106

no file limit

Inspector security/pgp-verify-signature

PGP Verify Signature

Overview

Check an OpenPGP signature on a message and get the facts one at a time instead of a single green tick. Five rows are reported: whether the signature is cryptographically valid, which key made it, what state that key is in — held, expired, revoked — when the signer says it was signed, and which digest was used. The headline is derived from the worst of them, and it has three states rather than two, because the middle one matters: a signature you hold no key for is shown as could not be checked, in warning rather than red or green, since nothing has failed and there is simply nothing to check against. A signature from an expired key still reads as valid, because it is; the expiry is reported on its own row, where it belongs. The signing time carries a permanent caveat that it is asserted by the signer and not proved. Cleartext-signed messages carry their signature with them; a detached signature has a second input of its own. Everything runs on openpgp.js in your browser, nothing is uploaded, and there is no trust column — the tool reports what it can check and names what it cannot.

Checking a signed announcementVerify a cleartext-signed security advisory or release note against the project's published key before acting on what it says.
Confirming a message came from a contactCheck the signature on an email against the public key you already hold for that person, and see at the same time whether their key has been revoked since you got it.
Catching a modified messageA single changed character breaks the signature, which makes verification a reliable check on whether the text you are reading is the text that was signed.
Identifying an unknown signerVerify a signature you have no key for and be told which key ID made it, so you know what to go and find rather than being shown a bare failure.
Teaching how signatures workSign something, change one character, and verify it again — with each fact reported separately, the difference between invalid, unchecked and valid-but-expired is visible instead of collapsed into one badge.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_verify_signature
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the signed message

A cleartext-signed message beginning -----BEGIN PGP SIGNED MESSAGE----- carries its signature with it, so that is all you need. For a detached signature there is a second box for the signature itself, because a detached signature is inherently two things.

Provide the signer's public key

Pick it from this browser's keyring or paste it in. If you have no key for the signature, that is reported as its own outcome rather than as a failure — an unchecked signature and an invalid one are not the same thing.

Read the rows, not a badge

You get five separate facts: is the signature cryptographically valid, which key made it, what state that key is in, when the signer says it was signed, and which digest was used. The headline is worked out from the worst of them.

Frequently asked

What does a valid signature actually tell me?

That the message has not changed by a single character since it was signed, and that the signature was made with the private key matching the public key you checked it against. It does not tell you who that key belongs to. Compare its fingerprint against a source you already trust — the signer in person, their website, a published key — because a name inside a user ID is just text somebody typed.

Why does it say the signature could not be checked?

Because no key you provided or hold matches the one that made it. That is a third outcome, shown as a warning rather than as red or green, and it is the honest one: nothing has failed, there is simply nothing to check against. Import the signer's public key and run it again.

The signing key is expired. Is the signature bad?

No. The arithmetic is sound and the headline still reads as valid — an expired key verifies signatures it made while it was live perfectly well. Expiry is reported on its own row because it means something different: do not encrypt anything new to that key. A revoked key is reported the same way, with the reason given.

Is the signing time proof of when it was signed?

No, and the tool says so beside the date every time. The timestamp is written into the signature by whoever made it and is as trustworthy as they are. If you need provable time, that is what a timestamping authority is for; PGP does not provide one.

Why did verification fail?

If it comes back invalid, one of two things is true: the message changed after signing, even by a character of whitespace, or the signature was not made by the key you checked it against. Copy-paste is a common culprit, since mail clients rewrap lines and a cleartext signature covers the text exactly as it was signed.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools