Log In Get Started
Free tool

Sign a message

Encryption answers the question of who can read. A signature answers a different one: is this really what they wrote. Sign a text with your key, and anyone who has your public key can confirm the message is yours and was not altered. The keys never leave the tab.

The public key can be handed to anyone; the secret key, to no one, ever.

No key? Make a pair on the Keys tab — it can also derive a key from a passphrase.

Keys, text and signature go nowhere: everything is computed in this tab.

What it looks like in a conversation

A signed message is your text with one line appended at the bottom, shaped like --404SIG1 key.signature. The text stays readable: a signature hides nothing, it only proves authorship. The recipient copies the whole block, opens this page on the Verify tab and pastes it in.

It is the block that must be copied, not the text on its own. A signature is computed byte by byte: an extra space, a different line break or auto-replaced quotation marks and the check will not match, although everything looks the same.

What a signature does not prove

It proves that the text was written by the owner of a particular key and has not changed since. It does not prove that this key belongs to the person they claim to be: that you learn another way — from a website, from a channel’s pinned message, from a business card. If the key came in the same message as the signature, the check means nothing: both can be forged at once.

Nearby: encrypt text with a password, encrypt a file and split a secret into parts.

We store neither keys nor texts

Just as there are no visit logs in the VPN itself: there is nothing to hand over on request.

How it works →

FAQ

guest@404vpn:~$ cat sign-faq.md
[01] $ How is a signature different from encryption? ▸
> Encryption hides the contents: only whoever has the key can read it. A signature hides nothing — the text stays open — but it proves two things at once: that the owner of the key wrote it, and that since signing the text has not changed by a single character. Those are different jobs, and often it is the second one you need.
[02] $ Where do I get the sender’s public key? ▸
> From somewhere it has already been confirmed another way: the company’s website, a channel’s pinned message, a business card. A signature proves the text was written by the owner of a particular key — but that this key belongs to the right person is something you learn elsewhere. If the key arrived in the same message as the signature, the check means nothing.
[03] $ Why does the signature not match when the text is the same? ▸
> Then the text is not the same after all. A signature is computed byte by byte: a trailing space, a different line break, quotation marks auto-replaced by a messenger — and the check honestly fails. So copy the whole block including the signature line, not the text on its own.
[04] $ Can I avoid storing a secret key? ▸
> You can derive it from a passphrase — then there is nothing to store, you only have to remember the phrase. But the salt in that case is the same for everyone, otherwise the key would not be reproducible: which means a weak phrase directly means a forgeable signature. Take a long phrase of unrelated words — or store a random key and do not rely on memory.
[05] $ Do you store keys? ▸
> No. Neither keys, nor texts, nor signatures: the page makes not a single network request while it works. We will not be able to recover a lost secret key — we never had it.