# Digital Signature Generator

Sign a message with a private key or verify a signature with a public key — supports RSA-PSS (SHA-256), ECDSA (P-256), and Ed25519. Pure client-side crypto (Node crypto.createSign/createVerify), no network. Paste a PEM key to sign or to verify a base64 signature. This tool signs/verifies; it does not generate key pairs.

> Canonical page: https://elysiatools.com/en/tools/digital-signature-generator

- **Category:** Security

- **Keywords:** digital signature, sign, verify, rsa-pss, ecdsa, ed25519, pem, pki, asymmetric, cryptography, authenticity

## Overview

This tool performs **asymmetric digital signatures** — the cryptography behind code signing, software provenance (Sigstore/SLSA), document signing, and authenticated APIs.

**Two modes:**
- **Sign**: paste a message and a PEM **private key**, get back a base64 signature.
- **Verify**: paste a message, a PEM **public key**, and a base64 signature, get VALID/INVALID.

**Three algorithms** (chosen to match the key type you paste):
- **RSA-PSS (SHA-256)** — the modern RSA signature scheme (probabilistic, salted). Preferred over the older PKCS#1 v1.5. Requires an RSA private/public key.
- **ECDSA (P-256, SHA-256)** — elliptic-curve signatures; shorter keys than RSA for equivalent security. Uses the IEEE P1363 (`r‖s`) encoding for deterministic, fixed-width output. Requires an EC P-256 (prime256v1) key.
- **Ed25519** — fast, deterministic EdDSA over Curve25519; one signature length (64 bytes), no parameter selection. Requires an Ed25519 key.

**How to use.** First generate a key pair with the **RSA Key Generator** or **SSH Key Generator** (this tool intentionally does *not* generate keys). Then:
1. Sign a message with the private key → copy the base64 signature.
2. Hand the recipient the message + signature + your **public** key.
3. They paste all three here, select the matching algorithm, and verify.

**Key/algorithm matching.** The algorithm must match the key type: an RSA key only works with RSA-PSS, an EC P-256 key with ECDSA, an Ed25519 key with Ed25519. A mismatch yields a verification error.

**Security.** All signing happens locally in your browser via Node's `crypto` module — the private key never leaves your device. Signatures are non-repudiable: only the holder of the private key could have produced a signature that the public key verifies.

## Inputs

- **Mode** (select)
- **Algorithm** (select)
- **Message** (textarea): The message to sign or verify.
- **Private Key (PEM)** (textarea): -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- (Used in Sign mode.)
- **Public Key (PEM)** (textarea): -----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY----- (Used in Verify mode.)
- **Signature (base64)** (textarea): Paste the base64 signature to verify. (Used in Verify mode.)

## When to use

- When you need to generate a secure, non-repudiable base64 signature for a text message or payload using a PEM private key.
- When you need to verify the authenticity and integrity of a received message using the sender's PEM public key and signature.
- When testing API authentication schemes, webhook signatures, or software provenance steps locally without sending sensitive keys over the network.

## How it works

- Select the operation mode: choose 'Sign' to generate a signature, or 'Verify' to validate an existing one.
- Select the cryptographic algorithm (RSA-PSS, ECDSA, or Ed25519) that matches your PEM key type.
- Input the message text along with the corresponding PEM private key (for signing) or PEM public key and base64 signature (for verification).
- The tool processes the input locally using client-side cryptographic functions to output the base64 signature or a validation verdict.

## Use cases

- Signing API request payloads to authenticate client requests for secure web services.
- Verifying webhook payloads received from third-party providers to ensure they originated from the trusted source.
- Validating software release manifests or configuration files against a known developer public key.

## Frequently asked questions

### Does this tool send my private keys to a server?

No. All cryptographic operations are performed locally in your browser using client-side code, ensuring your private keys never leave your device.

### Can I generate new public/private key pairs with this tool?

No, this tool is designed exclusively for signing and verifying. You can generate key pairs using an RSA or SSH key generator tool.

### Why am I getting a verification error or invalid status?

Ensure that the selected algorithm matches your key type (e.g., RSA-PSS for RSA keys) and that the message, public key, and signature match exactly.

### What signature formats does this tool support?

It supports RSA-PSS (SHA-256), ECDSA (P-256, SHA-256) with IEEE P1363 encoding, and Ed25519, outputting or verifying signatures in base64 format.

### What is the difference between RSA-PSS and older RSA signature schemes?

RSA-PSS is a modern, probabilistic signature scheme that incorporates salt, making it more secure than the older PKCS#1 v1.5 standard.

## Related tools

- [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.
- [Ed25519 / X25519 Keygen and Signature Verifier](https://elysiatools.com/en/tools/ed25519-x25519-keygen-signature-verifier): Generate Ed25519 or X25519 keypairs from random or deterministic seed text, then sign or verify messages
- [Data URI Generator](https://elysiatools.com/en/tools/data-uri-generator): Convert files into Data URIs (Base64 or percent-encoded) for inlining images, fonts, and assets directly into HTML, CSS, or Markdown
- [RSA Encrypt / Decrypt](https://elysiatools.com/en/tools/rsa-encrypt-decrypt): Encrypt text with an RSA public key or decrypt ciphertext with the matching private key, using OAEP padding (SHA-1 or SHA-256). Handles long messages by chunking. Keys and data stay local. PKCS#1 v1.5 is intentionally not offered (Node disables it for decryption due to Bleichenbacher attacks).
- [Secure Random Generator](https://elysiatools.com/en/tools/secure-random-generator): Generate cryptographically secure random key material driven by entropy budget — request N bits of entropy, get hex/base64/base64url output. Also supports custom-alphabet strings via crypto.randomInt (rejection-sampled, no modulo bias). Use this instead of Math.random()-based tools for any secret/key/token.
- [AGEX Secure Share Note](https://elysiatools.com/en/tools/agex-secure-share-note): Generate a plain-language share note for an AGEX bundle so recipients know how to decrypt and verify it safely
- [JWK Generator & Parser](https://elysiatools.com/en/tools/jwk-generator): Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata
- [Numeric OTP Generator](https://elysiatools.com/en/tools/otp-generator): Generate cryptographically secure one-time numeric codes (SMS / email verification, raffle codes, event pins) with configurable length (3-10 digits), bulk output, optional ambiguous-digit exclusion, and an optional expiry countdown. Uses crypto.randomInt, not Math.random.

## Samples

- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Rust Samples](https://elysiatools.com/en/samples/web-image-processing-rust): Web Rust image processing examples including image read/save, scaling, and format conversion

## Related content

- [Audio Encoding and Format Conversion Tools](https://elysiatools.com/en/hubs/audio-convert): Compare audio format conversion, bitrate changes, sample-rate conversion, codec swaps, and export tools in one hub for delivery and archive workflows.
- [Image Format Conversion and Animated Export Tools](https://elysiatools.com/en/hubs/image-convert): Compare image format converters for JPG, PNG, GIF, AVIF, WebP, TIFF, ICO, base64, and animation-friendly exports in one hub.
- [JSON Interchange and Format Translation Tools](https://elysiatools.com/en/hubs/json-convert): Compare JSON conversion tools for CSV, YAML, TOML, GraphQL, XML, Markdown, Excel, BSON, EDN, and related structured formats in one hub.
- [Color Space Conversion Tools for Web and Print](https://elysiatools.com/en/hubs/design-convert): Curated tools for web-to-print color space conversion in one hub.