PGP message verifier
Verify an OpenPGP signed message in your browser against public keys you trust. Works with clear-signed messages, inline signed messages and detached signatures, without contacting a key server.
Messages and signed text up to 1000000 characters each, public keys up to 200000 characters and 20 keys, up to 16 MiB after decompression. Everything runs locally in a background worker. Download a JSON report and the signed text. Paste a clear-signed or inline signed message, or a detached signature. Up to 1,000,000 characters. Review the settings before running.
Your result
How to use PGP message verifier
- Paste the signed message, or a detached signature block.
- Paste the public keys of the people you expect to have signed it.
- For a detached signature, paste the exact signed text as well.
- Run the tool and read the verdict and the checks for each signature.
Useful next steps
How it verifies
Messages follow RFC 9580 (July 2024). Clear-signed text is canonicalized as section 7 requires: dash-escaping is undone, trailing spaces and tabs are removed and lines end with CRLF. Only Hash lines that list hash algorithm names may follow the BEGIN line; any other header line stops the check. For text signatures in inline and detached messages, CR, LF and CRLF line endings become CRLF and every other byte is checked as it is. Inline messages may use ZIP or ZLIB compression. Version 4 and version 6 signatures from RSA, ECDSA, Ed25519 and legacy EdDSA keys are checked with Web Crypto.
Key checks
A signature only counts when the signing key is bound to its certificate by a valid self-signature, may sign, is not revoked and was valid when the signature was made. Signing subkeys also need their back-signature. Signatures dated after your check time are rejected. As RFC 9580 section 9.5 requires, signatures that use SHA-1, MD5 or RIPEMD-160 are not accepted, on the message or as key self-signatures, and EdDSA signatures need a hash of at least 256 bits; the report marks these weak-hash. Revocations made with SHA-1 still count.
Not supported
Encrypted messages, BZip2 compression, DSA keys, third party certifications and key server lookups are not handled. A valid result shows which key signed; confirm that key's fingerprint with its owner.