# RSA Signature Verifier

> Check whether a Base64 RSA signature is valid for a message and public key. SHA256withRSA and PSS supported.

URL: https://uttir.com/rsa-verify
Categories: security-tools, developer-tools
Privacy: Verification runs in this browser tab. Your public key and the message are never sent anywhere, and nothing is stored.

## About

Check that a signature really came from the holder of a private key. Paste the public key, the signed message, and the Base64 signature; you get a plain yes or no, and a reason when it is a no.

A signature that fails usually means one of three things: the message differs by a single character, the wrong public key was used, or the signature was made with a different padding scheme than the one you are checking against.

## How to use

1. **Paste the public key** — X.509/SPKI (BEGIN PUBLIC KEY) or a raw Base64 body.
2. **Paste the message** — The exact text that was signed.
3. **Paste the signature** — The Base64 value.
4. **Check the result** — Valid, or invalid with the reason why.

## FAQ

### Why does a valid signature fail?

Most often the message differs — a trailing newline, a different timestamp, or a space is enough. Also check the padding: a signature made with RSASSA-PSS will not verify as SHA256withRSA, and the other way round.

### Is the public key sensitive?

No — a public key is meant to be shared. But this tool still keeps it in the tab and sends it nowhere, so there is nothing to leak.

### Can it verify a JWT?

Yes. A JWT is signed over its header and payload joined by a dot, so paste that exact string and the token's signature.

## Related tools

- [RSA Signature Generator (SHA256withRSA)](https://uttir.com/rsa-sign) — Sign a string with your RSA private key and get the Base64 signature. Accepts PKCS#8 and PKCS#1 keys.
- [SNAP / QRIS Request Signer](https://uttir.com/snap-string-to-sign) — Build the stringToSign and X-SIGNATURE for Indonesian payment APIs. Handles the B2B token and transactional forms.
- [RSA Key Generator](https://uttir.com/rsa-keygen) — Generate an RSA key pair in your browser. 2048, 3072 or 4096 bits, exported as PEM — nothing is uploaded.
- [JWT Decoder](https://uttir.com/jwt-decoder) — Decode a JWT’s header and payload and check its expiration — without sending it anywhere.

---

For the full HTML page with the live tool, visit https://uttir.com/rsa-verify.
This file is the markdown rendering at https://uttir.com/rsa-verify.md. See https://uttir.com/llms.txt for a site-wide summary.