RSA Signature & Verification Tool
Create RSASSA-PKCS1-v1_5 signatures with an RSA private key, or verify a Base64 signature with the public key. Supports SHA-256, SHA-384, SHA-512, and PKCS#8/PKCS#1 PEM keys, entirely in your browser.
FreeOnline Tool
Loading…
How to Use
Switch between Sign and Verify, choose a hash algorithm, then provide the matching key and message.
- Choose a mode: Sign requires a private key; Verify requires a public key and a Base64 signature.
- Select the hash algorithm (SHA-256, SHA-384, or SHA-512). Signing and verification must use the same algorithm.
- Paste the PEM key: private keys may be PKCS#8 (BEGIN PRIVATE KEY) or PKCS#1 (BEGIN RSA PRIVATE KEY); public keys may be SPKI (BEGIN PUBLIC KEY) or PKCS#1 (BEGIN RSA PUBLIC KEY).
- Enter the message; in Verify mode also paste the Base64 signature (line breaks are allowed).
- Click Sign or Verify. Copy signature copies the output; verification shows pass or fail directly.
- Use Load sample data to sign with the built-in demo keys, or Generate new key pair to create a 2048-bit RSA pair that exists only on the current page.
Note: encrypted private keys (BEGIN ENCRYPTED PRIVATE KEY) are not supported and must be decrypted first. Only RSA keys are accepted, and the message must not be empty.
Features
- Two working modes: sign with a private key, verify with a public key; signatures are output as Base64 text.
- Supports SHA-256, SHA-384, and SHA-512; the same hash must be used for signing and verification.
- Private keys may be PKCS#8 or PKCS#1 PEM; public keys may be SPKI or PKCS#1 PEM. The imported key is checked to confirm its algorithm OID is RSA.
- Uses the WebCrypto RSASSA-PKCS1-v1_5 scheme (not RSA-PSS), which fits typical OpenSSL, Java, and Node.js signing integrations.
- The Generate new key pair button creates a 2048-bit RSA key pair in PEM format, held only in page memory.
- Load sample data fills in built-in demo keys and signs immediately, so you can confirm the tool works.
- All keys and messages are processed locally in the browser and are never uploaded.
Use Cases
Validate an integration's signature logic
Verify Base64 signatures on callback payloads with the provider's public key, or sign with a test private key to confirm the expected hash and scheme.
Debug mismatched signature results
Sign the same message here and with OpenSSL, Java, or Node.js, then compare results to isolate a hash, key-format, or scheme (PKCS#1 v1.5 vs PSS) mismatch.
Create temporary test keys
Generate a 2048-bit RSA key pair in PEM format for local integration tests without installing OpenSSL.
Teach how digital signatures work
Switch between Sign and Verify to show private-key signing, public-key verification, and verification failing after the message is altered.
FAQ
Which signature algorithm is used?
WebCrypto's RSASSA-PKCS1-v1_5 (PKCS#1 v1.5) scheme with SHA-256, SHA-384, or SHA-512. It is not RSA-PSS; if the other side requires PSS, signatures from this tool will not verify directly.
Why is my encrypted private key rejected?
The tool accepts only unencrypted PKCS#8 (BEGIN PRIVATE KEY) or PKCS#1 (BEGIN RSA PRIVATE KEY) private keys. A BEGIN ENCRYPTED PRIVATE KEY block must first be decrypted and exported as unencrypted PKCS#8, for example with OpenSSL.
Must signing and verification use the same hash?
Yes. If you sign with SHA-256, select SHA-256 when verifying as well; a mismatch produces a failed verification. Both modes share the same hash selector.
Which key formats are supported?
Private keys: PKCS#8 (BEGIN PRIVATE KEY) and PKCS#1 (BEGIN RSA PRIVATE KEY). Public keys: SPKI (BEGIN PUBLIC KEY) and PKCS#1 (BEGIN RSA PUBLIC KEY). Non-RSA keys such as EC are rejected.
Are my keys uploaded or stored?
No. Signing, verification, and key generation all run locally through the browser's WebCrypto API. Keys are not sent to any server or saved in local storage, and they disappear when the page is refreshed or closed.
How large is the generated key, and can the sample keys be used in production?
Generate new key pair always creates a 2048-bit RSA key that exists only on the current page. The built-in sample keys are for demonstration only and must not be used in production.