ECDSA Message Signer

How to generate a key pair and sign a message

An ECDSA digital signature lets you confirm that a specific text was signed with the private key corresponding to a given public key. The “ECDSA Message Signer” tool walks you through the entire process, and all calculations run in your browser.

1. Create a key pair. Click “New key pair”. This creates an ECDSA P-256 (secp256r1) key pair, and the public key in PEM (SPKI) format appears in the public key field. Any signature from a previous attempt is cleared.
2. Enter a message. Put the text you want to sign in the “Message” field. By default, it contains “important message” — you can replace it with any text.
3. Sign it. Click “Sign”. If no key pair exists yet, the tool creates one first, then computes an ECDSA-SHA-256 signature for your text encoded as UTF-8.
4. Get the result. The signature field will show a base64 string — exactly 64 bytes: 32 bytes for the r component and 32 bytes for the s component.

The private key never appears on the screen. It stays in your browser tab's memory and cannot be copied from there.

How to verify a signature with a public key

To verify a signature, you do not need the private key — the sender's public key, the signature itself, and the message content are enough.

1. Paste the public key in PEM (SPKI) format into the public key field. It can be a key you just generated or one someone sent you.
2. Paste the base64 signature into the signature field.
3. Enter exactly the same text that was signed in the message field — character for character.
4. Click “Verify”.

You will see one of two messages: “✓ signature valid…” when everything matches, or “✗ signature does NOT match…” when the signature does not correspond to this message and this key. The first result means that someone with the matching private key signed exactly this content and that the text was not changed along the way.

Before you enter anything, the tool shows a hint: Enter the public key and signature (or click “Sign” first).

Data formats: UTF-8, PEM/SPKI, base64 r||s

For the signature to match, both sides must use the same data encoding. Here is what the tool accepts:

The tool always uses the P-256 (secp256r1) curve and SHA-256. The signature therefore always has the same length, and there are no settings to change.

Security: local processing and the private key's ephemeral nature

Everything you do in the tool happens in your browser. Data is never sent anywhere — the message you enter, the key, and the signature never leave your computer.

The private key is even more ephemeral: it is created briefly in the tab's memory and is never displayed or exported. After you refresh the page, it simply disappears. For security, that is good news — there is nowhere to intercept it — but it also means you cannot recover it later. For ongoing signature work, you need a separate key management program.

You can, however, publish and share the public key freely. On its own, it does not allow anyone to sign messages; it is used only to check other people's signatures — so you can paste a key you received from someone else and verify a signature sent to you with it.

Limitations and what the tool does not do

It is worth knowing where this tool's capabilities end so you do not look for features it does not have.

• It does not import a private key. You cannot sign a message here with a key you already own. The tool always creates a new pair and signs only with that key.
• It does not save or export keys. After you refresh the page, the private key is lost, and the public key is not saved either — if you will need it, copy it beforehand.
• It does not read other signature formats. It accepts only the raw r||s representation in base64. Signatures stored differently, for example in DER format, will not be read.
• It does not support other curves or hashes. Only the P-256 (secp256r1) curve and SHA-256 are available. This is not secp256k1 known from Bitcoin and Ethereum, so you cannot verify signatures from those networks here.
• It does not assess trust. The tool will tell you only whether the signature matches the message and key. Whether the public key really belongs to the person it claims to belong to, and whether it was swapped, is something you must establish yourself.

For the result to be reliable, take care of two things: the message on the sender's and receiver's side must be identical character for character, including spaces and newline characters, and the public key must come from a trusted source.

Frequently asked questions

The tool uses the Web Crypto API in your browser. It is not a substitute for a cryptographic audit, and the private key is never saved. Before production use, confirm that the format matches what the recipient expects.