How to Verify Digital Signatures Online
Verify HMAC, RSA, and ECDSA signatures over an arbitrary payload using a public key or shared secret — useful for API integrations, JWTs, and webhook debugging.
More utilities that pair well with this guide:
Why this matters
When a vendor's webhook starts failing your verification, the cause is almost always one of: wrong key, wrong algorithm, wrong canonicalization, wrong encoding. Rather than inserting console.log everywhere in your verifier, paste the message and signature into a known-good verifier and compare results. That instantly tells you whether the bug is in your code or the message itself.
Three real scenarios
Paste the JWT, the public key, choose RS256/ES256/HS256, see "valid" or "invalid".
Bug isolated to handler
Use the vendor's published RSA public key to confirm the binary signature.
Provenance verified
Sign the payload with the secret, compare the result to the inbound header.
Code path validated
Walkthrough
Open the Signature verifier.
Paste the message
Use the exact bytes that were signed. For JWT, that is
header.payload; for AWS Sig V4 it is the canonical string-to-sign.Paste the signature
Hex or Base64 — pick the encoding that matches the source. The tool auto-detects common formats.
Provide the key
Symmetric: paste the secret string (or its Base64/hex). Asymmetric: paste the PEM-formatted public key.
Pick the algorithm
HS256 / HS384 / HS512 (HMAC), RS256 / RS512 (RSA-PKCS1), PS256 (RSA-PSS), ES256 / ES384 (ECDSA). The same JWT alg names also apply.
Read the verdict
"Valid" or "Invalid" with a one-line reason if invalid (algorithm mismatch, key parse error, signature length wrong).
Inputs
Message: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEifQ
Signature: L6S8LWkLzpcREMa8gxaaZbWwLNk0LgcBh6dRQpfIBrI
Key: MyVeryLongSharedSecretValue1234567890
Algorithm: HS256Result
Valid signature.
Power tips
- Always test with the vendor's reference vectors. Most providers publish a known good message + signature pair you can paste in to confirm the tool handles their exact algorithm.
- For JWTs, copy the header to confirm
algmatches what your verifier expects. Ignore unsigned tokens (alg=none) — that is an attack vector. - Use PSS for new RSA designs. PKCS#1 v1.5 (RS256) is fine but the cryptographic community favors RSASSA-PSS (PS256).
- Mind the canonical string. Subtle differences (a missing
\n, lowercase header name) flip the signature. Diff against a known-working capture to find them.
Common pitfalls
Common mistake
Public key in the wrong format
PEM keys come in BEGIN PUBLIC KEY (SPKI) and BEGIN RSA PUBLIC KEY (PKCS#1). The tool accepts both, but make sure you pasted the public key (not the certificate, not the private key).
Common mistake
The signature is Base64URL but parsed as Base64
JWT signatures use Base64URL (no padding, -_ alphabet). Set the input encoding accordingly or strip the difference manually.
Common mistake
Algorithm name mismatch
"sha256WithRSAEncryption" in OpenSSL is the same as "RS256" in JWT. Pick the correct alias on the dropdown.
When this is the wrong tool
- Issuing certificates belongs in OpenSSL or your CA.
- Verifying TLS server certificates is your browser's job; the chain validation logic is far more involved than a single signature check.
- Code-signing platform binaries (Windows Authenticode, Apple Developer ID) needs platform-specific tooling.
FAQ
Can I verify a Stripe / GitHub webhook here?
Yes. Use HS256 (HMAC-SHA-256), the secret from your dashboard, the raw body string, and the header value as the signature. The result tells you whether the request was tampered with.
Does it support Ed25519?
Ed25519 verification is on the roadmap. For now use a CLI like openssl pkeyutl -verify.
Is my key sent to a server?
No. WebCrypto runs locally; keys never leave the browser process.
Next steps
- Compute the HMAC side of the equation in the HMAC generator.
- Hash a payload separately if your protocol layers HMAC on top of a body hash with the Hash generator.
- Decode JWT segments with the Encode/Decode tool before pasting the message into the verifier.