b2KIT

PGP Sign & Verify Messages

Create PGP cleartext signatures and verify signed messages against a public key. Detached signature support included.

Tested tool guide Tested browser tools Checked August 16, 2026

What PGP Sign & Verify Messages does and how it behaves

Sign a plain-text message with your PGP private key, or check that signed text you received is genuine, entirely in the browser: nothing is uploaded. Cleartext signatures wrap the readable message and its signature in one armored block; detached signatures produce a separate .sig file covering a data file byte for byte. The part people get wrong is identity: a verified signature proves the message was signed by the private key matching the public key you pasted and has not been altered. It does not prove that key belongs to the person you think it does. Trusting the key is a separate step you take outside this tool.

How the result is produced

1

Cleartext signatures embed the message

Before signing, the message is normalized: lines beginning with a dash get a '- ' prefix, trailing whitespace is stripped, and line endings are normalized, per RFC 4880. The tool digests that canonical text, signs the digest with your private key, and emits one armored block holding message and signature. Verification recomputes the digest from the pasted text and checks it against the public key; a match means the pasted text is unchanged since signing.

2

Detached signatures cover a file

A detached signature is a signature packet with no message text, usually saved as a .sig or .asc file next to the data it covers. There is no canonicalization: the signature is computed over the data file as it exists on disk, so any single byte difference in a copy fails verification. Software projects publish these for release archives: they prove a downloaded file is bit-for-bit identical to the one the maintainer signed.

Good uses

  • Verifying a downloaded release archive against the maintainer's detached .sig and public key before running it.
  • Confirming that an announcement, contract term, or statement you received by email is unchanged and was signed with the sender's key.
  • Signing a message before publishing it on a mailing list, forum, or paste site so readers can check it against your public key.

Limits and checks

  • A valid signature proves only that the private key matching the public key you pasted signed the message; it never identifies a person. If you took that key from a page an attacker controls, the verified result is meaningless. Obtain keys through a channel you trust, and compare key fingerprints across independent sources.
  • Failed verification is not proof of tampering. An email client re-wrapping a long line, a retyped character, or a truncated armor block all fail verification though nothing malicious happened. For detached signatures, a single changed byte in the data file is enough. Diff the message text against the original to see what actually differs.
  • Signing is not encryption: the message stays fully readable to everyone who sees it, so a signed-only message protects nothing if confidentiality matters. And a detached signature says nothing about whether the signed program is safe to run; it only shows the file matches what the key owner signed, and a malicious actor can sign malware with their own key.

Common questions

Verification failed even though the message looks identical. What went wrong?

Most often an invisible difference: a line re-wrapped by the email client, a word edited after signing, or stray characters. Also confirm you pasted the correct public key and the entire armor block, from -----BEGIN to -----END, without truncation. For detached signatures, any byte change in the data file fails. Compare the two texts side by side to find the edit.

A valid signature means this key really belongs to the sender, right?

No. The tool establishes only that the signature matches the public key you supplied and that the message is unchanged; it cannot tie a key to a real person. To connect key to identity, get the key directly from the person or from a site you already trust, then compare key fingerprints across at least two independent channels.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.