# File signature verifier

- Human page: https://happytails.ai/en/developer-tools/file-signature-verifier/
- Markdown: https://happytails.ai/en/developer-tools/file-signature-verifier.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/file-signature-verifier/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `file-signature-verifier` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

The file is checked in your browser and never uploaded. One file of up to 64 MiB.

### Inputs and settings

No free-text input is required. Use the file inputs and/or settings below.

Accepted browser files: `See implementation notes`. Choose one file.

Browser file-input limit: 67108864 bytes in total. HTTP limits can differ.

| Setting | Meaning | Control type | Default | Constraints |
| --- | --- | --- | --- | --- |
| `publicKey` | Public key you trust | textarea | "" |  |
| `signature` | Signature | textarea | "" |  |
| `format` | Signature format | select | "auto" | Allowed: auto, sshsig, minisign, raw |
| `namespace` | SSH signature namespace | text | "file" |  |
| `rawAlgorithm` | Algorithm for raw signatures | select | "auto" | Allowed: auto, RSASSA-PKCS1-v1_5 SHA-256, RSASSA-PKCS1-v1_5 SHA-384, RSASSA-PKCS1-v1_5 SHA-512, ECDSA SHA-256, ECDSA SHA-384, ECDSA SHA-512, Ed25519 |

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

One file of up to 64 MiB, a public key and a signature of up to 20000 characters each. The file is read and hashed locally in a background worker; nothing is uploaded. Download a JSON report.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "file-signature-verifier",
  "category": "developer-tools",
  "built": true,
  "requirements": "One file of up to 64 MiB, a public key and a signature of up to 20000 characters each. The file is read and hashed locally in a background worker; nothing is uploaded. Download a JSON report.",
  "implementation": {
    "fields": [
      {
        "key": "publicKey",
        "label": "Public key you trust",
        "value": "",
        "type": "textarea",
        "help": "OpenSSH public key line, PEM public key or certificate, public JWK, or minisign public key."
      },
      {
        "key": "signature",
        "label": "Signature",
        "value": "",
        "type": "textarea",
        "help": "SSH SIGNATURE block, all four lines of a .minisig file, or a Base64 or hex signature."
      },
      {
        "key": "format",
        "label": "Signature format",
        "value": "auto",
        "type": "select",
        "values": [
          "auto",
          "sshsig",
          "minisign",
          "raw"
        ]
      },
      {
        "key": "namespace",
        "label": "SSH signature namespace",
        "value": "file",
        "type": "text"
      },
      {
        "key": "rawAlgorithm",
        "label": "Algorithm for raw signatures",
        "value": "auto",
        "type": "select",
        "values": [
          "auto",
          "RSASSA-PKCS1-v1_5 SHA-256",
          "RSASSA-PKCS1-v1_5 SHA-384",
          "RSASSA-PKCS1-v1_5 SHA-512",
          "ECDSA SHA-256",
          "ECDSA SHA-384",
          "ECDSA SHA-512",
          "Ed25519"
        ]
      }
    ],
    "registrationFamily": "crypto-formats-key-material",
    "files": true,
    "input": false,
    "maxFileBytes": 67108864,
    "note": "The file is checked in your browser and never uploaded. One file of up to 64 MiB.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 1000000,
      "inputMode": "text",
      "label": "File",
      "placeholder": "Choose the signed file",
      "help": "Pick the exact file that was signed, such as a release archive. Up to 1,000,000 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Check a detached signature for a file in your browser against a public key you trust. Supports SSH signatures from ssh-keygen -Y sign, minisign signatures and raw RSA, ECDSA or Ed25519 signatures from OpenSSL.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

### How to use File signature verifier

1. Choose the file that was signed.
2. Paste the public key you expect the signer to use.
3. Paste the signature text, such as the SSH SIGNATURE block or the .minisig file.
4. Run the tool and read the verdict and each check.

## Useful next steps

- [File hash](https://happytails.ai/en/developer-tools/file-hash/) ([Markdown](https://happytails.ai/en/developer-tools/file-hash.md))

- [HMAC generator](https://happytails.ai/en/developer-tools/hmac-generator/) ([Markdown](https://happytails.ai/en/developer-tools/hmac-generator.md))

- [RSA key generator](https://happytails.ai/en/developer-tools/rsa-key-generator/) ([Markdown](https://happytails.ai/en/developer-tools/rsa-key-generator.md))

## Formats

SSH signatures follow the OpenSSH PROTOCOL.sshsig format: the namespace must match and the key inside the signature must equal the key you paste. minisign signatures are checked for the key ID, the file signature (Ed25519, or Ed25519 over BLAKE2b-512 from RFC 7693 for prehashed signatures) and the trusted comment signature. Raw signatures from openssl dgst -sign or pkeyutl are checked with the algorithm you pick, or one chosen from the key type.

### What a valid result means

The file matches a signature made with the private key that belongs to your public key. Whether that key really belongs to the publisher is up to you, so get the key from a source you trust, not from the same download page as the file.

### Not supported

OpenPGP signatures, FIDO security key SSH signatures, SHA-1 based ssh-rsa signatures and RSA-PSS raw signatures are not checked here.