how do i verify a vendor's pgp message?

paste their official public key and the signed message into the verify tool. a valid result proves the message was created by the holder of that private key and was not modified afterwards.

what does a valid signature actually prove?

that the message was signed by the private key matching the public key you checked against, and that nothing was altered. it does not prove who controls that key unless you trust where you got the public key from.

what does an invalid signature mean?

either the message was modified after signing, the signature was forged, or you are checking against a different key than the one that signed. treat the message as untrusted until you have compared fingerprints over a second channel.

home / tools / pgp verify

pgp

key generator encrypt decrypt sign verify armor cleaner fingerprint compare

tor & coins

onion status onion validator vanity onion bitcoin validator monero validator

everyday

passphrase sha-256 text diff base convert

pgp verify

Q: where should i get the public key from?

always from an independent, official source - the person's own site or a profile they control - never from the same channel the suspicious message arrived on. an attacker can attach a fake key to their forged message.

got a message claiming to be from someone? check it against their public key. a valid signature means that key's owner really wrote it - and that nobody touched a single character on the way.

this tool auto-detects what you paste: clearsigned messages, detached signatures or encrypted blocks.

javascript is off - this form now posts to our server instead of verifying in your browser. the server path supports rsa signatures only (modern ed25519/curve25519 keys need javascript). your message and key are processed in memory during that one request - never stored, never logged.

paste what they sent you

original text (needed for a detached signature)

a detached signature covers exact bytes - make sure the original text is copied completely and unaltered.

paste their public key

get it from the sender's official source - their own site or a profile they control. never from the same channel the suspicious message came through: an attacker who fakes the message can attach a fake key to it just as easily.

a signature is only as trustworthy as the key you check it against. if the "public key" arrived in the same message or the same chat, verifying against it proves nothing.

check it

where should this run?

local · in your browser most private - nothing leaves your device. needs javascript. server · on our machine works without javascript. processed in memory during this one request - never stored or logged.

javascript is off: the local option is unavailable - your request runs on our server instead. it is processed in memory during this one request and never stored or logged.

privacy: with javascript enabled, verification runs entirely in your browser - nothing you paste ever leaves your device. without javascript the form posts to the server instead, where your message and key live in memory for the length of that single check - never stored, never logged, discarded when the response is sent. the javascript path is strongly preferred; note the no-javascript path supports rsa signatures only, while the browser handles modern keys too.

faq

what does a valid signature actually prove?: two things: the message was signed by the private key belonging to the public key you checked against, and not one character changed afterwards. it does not prove anything about who controls that key unless you trust where you got the public key from.
signature valid but the fingerprint looks different?: then you are verifying against a different key than intended - possibly an impersonator. always compare fingerprints over a second channel before trusting any result.
"encrypted message detected" - now what?: what you pasted is an encrypted block, not a signature. run it through the decrypt tool first; if it contains a signature you can verify the plaintext here afterwards.
i don't have their public key at all: then verification is impossible - anyone could have written the message. find the key on the person's official page or profile first.
the paste looks mangled and nothing parses?: copy-paste often flattens armor onto one line. this tool auto-repairs the common damage, but for badly broken blocks run it through the armor cleaner first.