Sign and verify messages with ECDSA using P-256, P-384, or P-521 curves via Web Crypto API.
ECDSA Digital Signature Tool creates and checks elliptic-curve signatures for message text with P-256, P-384, or P-521 through the browser's Web Crypto operations. Signing combines the exact message bytes with a private key; verification uses the corresponding public key and reports whether the supplied signature matches. A signature proves possession of the private key for that message, but it does not conceal the message. A frequent surprise is that signing identical text twice can produce different valid signatures because ECDSA uses a fresh per-signature value.
The message is encoded as bytes and hashed as part of the ECDSA operation. The selected private key and curve produce two signature integers, conventionally named r and s. Web Crypto represents them in fixed-width IEEE P1363 form, with r followed by s, rather than the ASN.1 DER sequence used by many certificate and command-line tools.
Verification processes the exact message again, interprets the supplied signature for the selected curve, and checks it with the public key. The result indicates validity; it does not recover the message or identify the signer. Changing one message byte, using the wrong public key, selecting incompatible parameters, or altering either signature component causes verification to fail.
ECDSA signing uses a per-signature secret value, so repeated signing can yield different r and s values even when the key and message are unchanged. That is expected, and both signatures can verify successfully. No, signature equality is not a reliable way to decide whether two ECDSA operations signed the same message.
Not necessarily. Web Crypto represents an ECDSA signature as fixed-size r || s data, while many certificate and command-line workflows expect an ASN.1 DER sequence containing two integers. The curve, hash, public key encoding, and message bytes must also agree. Direct use works when the receiving system accepts IEEE P1363; if it requires DER, conversion is necessary.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.