{
  "title": "PGP message verifier",
  "human_url": "https://happytails.ai/en/developer-tools/pgp-message-verifier/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/pgp-message-verifier/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/pgp-message-verifier.md",
  "content": "PGP message verifier\nVerify an OpenPGP signed message in your browser against public keys you trust. Works with clear-signed messages, inline signed messages and detached signatures, without contacting a key server.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use PGP message verifier\nPaste the signed message, or a detached signature block.\nPaste the public keys of the people you expect to have signed it.\nFor a detached signature, paste the exact signed text as well.\nRun the tool and read the verdict and the checks for each signature.\nUseful next steps\nFile hash\nBase64 encoder decoder\nJWT decoder\nHow it verifies\nMessages follow RFC 9580 (July 2024). Clear-signed text is canonicalized as section 7 requires: dash-escaping is undone, trailing spaces and tabs are removed and lines end with CRLF. Only Hash lines that list hash algorithm names may follow the BEGIN line; any other header line stops the check. For text signatures in inline and detached messages, CR, LF and CRLF line endings become CRLF and every other byte is checked as it is. Inline messages may use ZIP or ZLIB compression. Version 4 and version 6 signatures from RSA, ECDSA, Ed25519 and legacy EdDSA keys are checked with Web Crypto.\nKey checks\nA signature only counts when the signing key is bound to its certificate by a valid self-signature, may sign, is not revoked and was valid when the signature was made. Signing subkeys also need their back-signature. Signatures dated after your check time are rejected. As RFC 9580 section 9.5 requires, signatures that use SHA-1, MD5 or RIPEMD-160 are not accepted, on the message or as key self-signatures, and EdDSA signatures need a hash of at least 256 bits; the report marks these weak-hash. Revocations made with SHA-1 still count.\nNot supported\nEncrypted messages, BZip2 compression, DSA keys, third party certifications and key server lookups are not handled. A valid result shows which key signed; confirm that key's fingerprint with its owner.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "File hash",
      "url": "https://happytails.ai/en/developer-tools/file-hash/"
    },
    {
      "name": "Base64 encoder decoder",
      "url": "https://happytails.ai/en/developer-tools/base64-encoder-decoder/"
    },
    {
      "name": "JWT decoder",
      "url": "https://happytails.ai/en/developer-tools/jwt-decoder/"
    }
  ],
  "tool": {
    "id": "pgp-message-verifier",
    "category": "developer-tools",
    "built": true,
    "requirements": "Messages and signed text up to 1000000 characters each, public keys up to 200000 characters and 20 keys, up to 16 MiB after decompression. Everything runs locally in a background worker. Download a JSON report and the signed text.",
    "implementation": {
      "fields": [
        {
          "key": "publicKeys",
          "label": "Signer public keys you trust",
          "value": "",
          "type": "textarea",
          "help": "Armored public keys (-----BEGIN PGP PUBLIC KEY BLOCK-----). Nothing is fetched from key servers."
        },
        {
          "key": "signedText",
          "label": "Signed text (only for a detached signature)",
          "value": "",
          "type": "textarea",
          "help": "Paste the exact text that a detached PGP SIGNATURE block covers."
        },
        {
          "key": "time",
          "label": "Check signature dates against (UTC or Unix seconds)",
          "value": "2026-10-16T12:00:00Z",
          "type": "text"
        }
      ],
      "registrationFamily": "crypto-formats-signed-envelopes",
      "inputMaxLength": 1000000,
      "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_PGP_MESSAGE",
      "note": "Runs in your browser with no key server lookups. Messages up to 1000000 characters.",
      "experience": {
        "automatic": false,
        "single": false,
        "inputMaxLength": 1000000,
        "inputMode": "text",
        "label": "Signed message",
        "placeholder": "-----BEGIN PGP SIGNED MESSAGE-----",
        "help": "Paste a clear-signed or inline signed message, or a detached signature. Up to 1,000,000 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# PGP message verifier\n\n- Human page: https://happytails.ai/en/developer-tools/pgp-message-verifier/\n- Markdown: https://happytails.ai/en/developer-tools/pgp-message-verifier.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/pgp-message-verifier/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `pgp-message-verifier` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nRuns in your browser with no key server lookups. Messages up to 1000000 characters.\n\n### Inputs and settings\n\nText input: Signed message.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\n-----BEGIN PGP SIGNED MESSAGE-----\n```\n\nPaste a clear-signed or inline signed message, or a detached signature. Up to 1,000,000 characters. Review the settings before running.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `publicKeys` | Signer public keys you trust | textarea | \"\" |  |\n| `signedText` | Signed text (only for a detached signature) | textarea | \"\" |  |\n| `time` | Check signature dates against (UTC or Unix seconds) | text | \"2026-10-16T12:00:00Z\" |  |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nMessages and signed text up to 1000000 characters each, public keys up to 200000 characters and 20 keys, up to 16 MiB after decompression. Everything runs locally in a background worker. Download a JSON report and the signed text.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"pgp-message-verifier\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Messages and signed text up to 1000000 characters each, public keys up to 200000 characters and 20 keys, up to 16 MiB after decompression. Everything runs locally in a background worker. Download a JSON report and the signed text.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"publicKeys\",\n        \"label\": \"Signer public keys you trust\",\n        \"value\": \"\",\n        \"type\": \"textarea\",\n        \"help\": \"Armored public keys (-----BEGIN PGP PUBLIC KEY BLOCK-----). Nothing is fetched from key servers.\"\n      },\n      {\n        \"key\": \"signedText\",\n        \"label\": \"Signed text (only for a detached signature)\",\n        \"value\": \"\",\n        \"type\": \"textarea\",\n        \"help\": \"Paste the exact text that a detached PGP SIGNATURE block covers.\"\n      },\n      {\n        \"key\": \"time\",\n        \"label\": \"Check signature dates against (UTC or Unix seconds)\",\n        \"value\": \"2026-10-16T12:00:00Z\",\n        \"type\": \"text\"\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-signed-envelopes\",\n    \"inputMaxLength\": 1000000,\n    \"inputErrorCode\": \"CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_PGP_MESSAGE\",\n    \"note\": \"Runs in your browser with no key server lookups. Messages up to 1000000 characters.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": false,\n      \"inputMaxLength\": 1000000,\n      \"inputMode\": \"text\",\n      \"label\": \"Signed message\",\n      \"placeholder\": \"-----BEGIN PGP SIGNED MESSAGE-----\",\n      \"help\": \"Paste a clear-signed or inline signed message, or a detached signature. Up to 1,000,000 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nVerify an OpenPGP signed message in your browser against public keys you trust. Works with clear-signed messages, inline signed messages and detached signatures, without contacting a key server.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use PGP message verifier\n\n1. Paste the signed message, or a detached signature block.\n2. Paste the public keys of the people you expect to have signed it.\n3. For a detached signature, paste the exact signed text as well.\n4. Run the tool and read the verdict and the checks for each signature.\n\n## Useful next steps\n\n- [File hash](https://happytails.ai/en/developer-tools/file-hash/) ([Markdown](https://happytails.ai/en/developer-tools/file-hash.md))\n\n- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))\n\n- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))\n\n## How it verifies\n\nMessages follow RFC 9580 (July 2024). Clear-signed text is canonicalized as section 7 requires: dash-escaping is undone, trailing spaces and tabs are removed and lines end with CRLF. Only Hash lines that list hash algorithm names may follow the BEGIN line; any other header line stops the check. For text signatures in inline and detached messages, CR, LF and CRLF line endings become CRLF and every other byte is checked as it is. Inline messages may use ZIP or ZLIB compression. Version 4 and version 6 signatures from RSA, ECDSA, Ed25519 and legacy EdDSA keys are checked with Web Crypto.\n\n### Key checks\n\nA signature only counts when the signing key is bound to its certificate by a valid self-signature, may sign, is not revoked and was valid when the signature was made. Signing subkeys also need their back-signature. Signatures dated after your check time are rejected. As RFC 9580 section 9.5 requires, signatures that use SHA-1, MD5 or RIPEMD-160 are not accepted, on the message or as key self-signatures, and EdDSA signatures need a hash of at least 256 bits; the report marks these weak-hash. Revocations made with SHA-1 still count.\n\n### Not supported\n\nEncrypted messages, BZip2 compression, DSA keys, third party certifications and key server lookups are not handled. A valid result shows which key signed; confirm that key's fingerprint with its owner.\n"
}