ECDSA Sign & Verify
Sign a message with an elliptic-curve private key and verify it with the matching public key.
Input
Private key
Signature (Base64)
What a signature proves
A valid signature says two things: the message was signed by whoever holds the private key, and not one byte has changed since. It says nothing about when it was signed or whether the signer meant it — that is what timestamps and protocol design are for.
Signing uses the private key; verifying uses the public one. If verification is rejecting your key, check you pasted the public half — this tool refuses a private key for verification rather than silently deriving one.
- RSASSA-PKCS1-v1_5 — the older, deterministic scheme. Still what most JWT libraries mean by RS256.
- RSA-PSS — the modern randomised scheme, with a stronger security proof. Preferred for new designs.
- ECDSA — elliptic curve. Much smaller signatures; ES256 in JWT terms.
Frequently asked questions
Why does the same message give a different signature each time?
With RSA-PSS and ECDSA, yes — both incorporate randomness by design, and both signatures verify. RSASSA-PKCS1-v1_5 is deterministic and repeats.
Verification fails with a key I am sure is right.
Usually the hash or the algorithm differs from the one used to sign, or the message has a trailing newline on one side. Both sides must agree on all three.
How do I get a public key from a private one?
openssl rsa -in private.pem -pubout for RSA, or openssl ec -in private.pem -pubout for elliptic curve.