File signature verifier
Check a detached signature for a file in your browser against a public key you trust. Supports SSH signatures from ssh-keygen -Y sign, minisign signatures and raw RSA, ECDSA or Ed25519 signatures from OpenSSL.
Accepted files: see this tool’s format requirements. Choose one file. Up to 64 MiB in total.
One file of up to 64 MiB, a public key and a signature of up to 20000 characters each. The file is read and hashed locally in a background worker; nothing is uploaded. Download a JSON report. Pick the exact file that was signed, such as a release archive. Up to 1,000,000 characters. Review the settings before running.
Your result
How to use File signature verifier
- Choose the file that was signed.
- Paste the public key you expect the signer to use.
- Paste the signature text, such as the SSH SIGNATURE block or the .minisig file.
- Run the tool and read the verdict and each check.
Useful next steps
Formats
SSH signatures follow the OpenSSH PROTOCOL.sshsig format: the namespace must match and the key inside the signature must equal the key you paste. minisign signatures are checked for the key ID, the file signature (Ed25519, or Ed25519 over BLAKE2b-512 from RFC 7693 for prehashed signatures) and the trusted comment signature. Raw signatures from openssl dgst -sign or pkeyutl are checked with the algorithm you pick, or one chosen from the key type.
What a valid result means
The file matches a signature made with the private key that belongs to your public key. Whether that key really belongs to the publisher is up to you, so get the key from a source you trust, not from the same download page as the file.
Not supported
OpenPGP signatures, FIDO security key SSH signatures, SHA-1 based ssh-rsa signatures and RSA-PSS raw signatures are not checked here.