b2KIT

PGP Signature Verifier

Verify PGP/GPG digital signatures against public keys and sign messages with private keys.

Tested tool guide Tested browser tools Checked August 16, 2026

What PGP Signature Verifier does and how it behaves

Is a file or email from the person it claims to be from? A PGP signature answers that with math: paste the signed message, or its detached .sig file, plus the signer's public key, and the tool hashes the message and compares it against the digest the signature was computed from. A good signature means the message is byte-for-byte what the private key holder signed. It can also sign messages with a private key. The surprise: a good signature proves only that the private key matched the public key. It does not prove that the key, or the name on it, belongs to who you think. That trust is built separately.

How the result is produced

1

How verification works

The signature packet records the hash algorithm the signer used, typically SHA-256. The tool hashes the exact message bytes, then uses the public key to verify the signature against that digest. Equal means a good signature; any difference means the message, signature, or supplied key is wrong. OpenPGP hashes the message together with the signature packet body and a final trailer, which binds the signature to this exact message and to the algorithms recorded in the packet, so it cannot be transplanted from one message to another.

2

Signing and the armored formats

To sign, the tool needs the message, the private key, and the passphrase if the key has one. Output is ASCII-armored text: a cleartext-signed block that wraps the message, or a detached -----BEGIN PGP SIGNATURE----- block meant to sit beside a file such as release.sig. Cleartext signatures dash-escape message lines beginning with a hyphen, so verification must unescape them before hashing.

Good uses

  • Verify a downloaded release, installer, or ISO against the maintainer's detached .sig file and public key before running it, as package managers do for every package.
  • Confirm that an email, PDF, or public statement claiming to come from a specific person really was signed by that person and was not altered.
  • Sign your own messages and files with your private key so recipients can verify the content is yours and unchanged.

Limits and checks

  • A good signature does not make the key trustworthy. If you got the public key from the same website, email, or person as the signed content, someone controlling that channel controls both halves of the check. Confirm the key's fingerprint through an independent channel first.
  • The message must match byte for byte. Re-saving a file can change line endings (CRLF to LF) or add a trailing newline; copying text through an editor can reflow or truncate it. Any of these makes a genuine signature fail, so a bad result does not always mean tampering.
  • The name and email address in a key are self-asserted; anyone can generate a key bearing anyone else's name. A signature can also verify cleanly after the key has expired or been revoked, so key status and signature validity are separate questions.

Common questions

I only have the signed file, not a public key. Can I still verify it?

No. Verification is a two-party check: without the signer's public key there is nothing to test the signature against. Obtain the key from the signer's own site or a keyserver, and confirm its fingerprint through a second channel, because a website or keyserver alone can be impersonated.

If I sign a message with my private key here, is my key uploaded anywhere?

No. Signing and verification run entirely in the browser, and nothing is uploaded. The honest caveat: a web page cannot prove its own honesty, so only paste a private key into a tool you trust, and keep the key passphrase-protected so a leak still requires the passphrase.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.