RSA-PSS Sign & Verify

Sign locally with a private key, verify with a public key, and control the PSS salt length explicitly.

Public key (SPKI PEM)

Private key (PKCS#8 PEM)

Message

Hash

Salt length (bytes)

Signature (Base64)

ReadyVerification only proves the signature matches the supplied public key and message; it does not establish who owns that key.

All cryptographic operations run locally in your browser. Keep private keys secret and use production key-management practices for real systems.

RSA-PSS Tool: Salt, Key Size & Fingerprint Audit

Sign and verify locally while auditing modulus size, hash, salt limit, signature bytes and public-key fingerprint.

Browser-local cryptographic utilities

preserves the established Web Crypto workflows while connecting token, key, KDF, encryption/signature, fingerprint and verification jobs. Inputs stay in your browser unless the page clearly states that a network request is required.

Protocol boundary

Correct primitive output does not certify a complete protocol, key-management system, parameter choice, endpoint, or production deployment. Match the source system exactly and use established application/security libraries for production authentication and storage.

Practical guide and verification

Use RSA-PSS parameters as part of the protocol

A signature is not defined only by the RSA key. The hash function, mask-generation behavior and salt-length policy must agree between signer and verifier. Record those choices with the protocol instead of treating a successful local test under one browser default as proof that another system will use the same parameters.

Sign the exact bytes, not the visual appearance

Whitespace, line endings, text encoding and Unicode normalization can change the byte sequence while leaving text looking almost identical. When interoperability matters, define whether the signed input is UTF-8 text, a file digest, canonical JSON or another deterministic representation and reproduce that representation during verification.

Keep private-key handling separate from signature verification

Verification requires only the public key. Avoid moving a private key into systems that only need to verify signatures, and do not paste production private keys into troubleshooting environments unless the security process explicitly permits it. Browser-local processing reduces server exposure but does not make key handling consequence-free.

Distinguish signature validity from signer identity

A valid RSA-PSS signature proves that the supplied public key verifies the supplied message and signature under the selected parameters. It does not prove who owns that public key. Identity normally depends on a certificate, pinned key, authenticated key exchange or another trusted distribution mechanism.

Run a negative verification test

After a successful sign-and-verify round trip, change one character of the message or signature and confirm verification fails. That negative test is a useful integration check because it verifies that the application is actually binding the signature to the intended bytes rather than displaying a stale success state.