OpenPGP Signature Creator & Verifier
Create or verify detached, attached and cleartext OpenPGP signatures for text and files, with explicit signer fingerprints and failure states.
Choose the signature form
Detached signs the exact input bytes and returns a separate signature; verification needs both the original content and signature. Attached wraps the content in a signed OpenPGP message. Cleartext is for readable text and uses OpenPGP’s canonical line-ending and trailing-whitespace rules.
Textareas may normalize pasted CRLF before processing. Use a file and a detached or attached signature for exact binary bytes, BOM and line endings. Signature files can be ASCII armor or binary; pasted binary signatures use the selected explicit encoding. Cleartext mode intentionally accepts text only.
Verification results and exported content
Reports distinguish verified, failed and unknown-key signatures, including the matching primary and signing-key fingerprints. A failed check may involve signature math, key validity or policy; it does not by itself diagnose the exact cause. Names and email addresses in keys are not identity proof.
Attached or cleartext content is offered for download only when every supplied signature verifies. Detached results export a verification report. Plain signing input is capped at 16 MiB, signed containers at 24 MiB, detached signatures at 1 MiB and decompression at 16 MiB. Verification does not fetch missing keys.
Reference
Questions & answers
Can I verify with the wrong public key?
The report identifies that no supplied key verifies the signature. It does not silently treat the content as verified or export unverified attached content.
Does Cleartext preserve every byte?
No. It has text-specific canonicalization rules. Use file input with Detached or Attached when byte-for-byte preservation is required.
Is my input uploaded or saved?
Processing runs in your browser. The tool does not put keys, passwords or content in URLs or local storage, or send them to a processing API. Clear removes visible inputs and outputs; it does not guarantee secure erasure of browser-managed memory.