Verify an OpenPGP detached signature in your browser
Release files, security advisories and disclosures often arrive as a file plus an ASCII-armored OpenPGP signature and public key. Paste all three below, or pick them from local files, and this page parses the RFC 9580 packet structure itself: the armor with its CRC24 checksum, the public-key packet, and the signature packet in both v4 and v6 form. Verification runs with the MIT-licensed @noble/curves and @noble/hashes libraries tree-shaken and inlined into this page, so nothing leaves the browser. The result is VALID, INVALID or UNSUPPORTED with the algorithm id, alongside the key fingerprint, key id, signature creation time, and the key expiry when the key carries one.
๐ All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data โ use synthetic or anonymised inputs only.
The three inputs
Detached signature
Signer public key
Signed artifact
Signature details
Every field below is read from the packets themselves; the fingerprint and key id are recomputed from the key material, never taken from a text label inside the armor.
Algorithms this version verifies: Ed25519 legacy EdDSA (public-key algorithm 22 on v4 keys), Ed25519 (algorithm 27 on v6 keys) and ECDSA NIST P-256 (algorithm 19), over signature packets v4 and v6 with the hash algorithms SHA2-256, SHA2-384 and SHA2-512. RSA keys and signatures (algorithm ids 1 to 3) report UNSUPPORTED with the algorithm id shown. This page verifies signatures; it does not sign or generate keys and offers no private key input.
Fixtures and library provenance: the two fixture key pairs were generated with gpg on 2026-10-29 solely for this page and were never used anywhere else; each golden set verifies VALID and the tampered twin artifact (release 1.0.0 changed to 1.0.1) reads INVALID. The RFC 9580 Appendix A sample key and signatures are bundled too, so a #selftest=1 fragment runs 14 checks against both the gpg fixtures and the standard's own bytes. The cryptography is @noble/curves and @noble/hashes 2.2.0 (MIT), tree-shaken outside the repo and inlined here with their licence headers kept; OpenPGP.js (LGPL-3.0) is intentionally left out.