// septim forge tools · crypto-adjacent

Ed25519 Signature Verifier

client-side · zero network calls · no telemetry · no login

Verify only. This tool does not generate keys or sign messages — only verifies a signature you have already created elsewhere. No private key is required or accepted. Paste a public key, a message, and a signature; this tool tells you whether the signature is valid.

// verify signature

Public key

Message

Message encoding: UTF-8 text Hex bytes

Signature

// verify zero network calls

How to confirm nothing leaves your browser

// devtools network tab

Open DevTools (F12 or Cmd+Option+I), click the Network tab. After the page finishes loading its fonts and CSS, paste your inputs and click "Verify signature." Watch the Network tab — zero new requests fire. The crypto.subtle.importKey() and crypto.subtle.verify() calls execute entirely inside the browser's built-in WebCrypto engine.

Browser compatibility: Ed25519 in WebCrypto requires Chrome 113+, Firefox 130+, or Safari 17+. If your browser is older, this tool will display a compatibility error rather than silently failing. Node.js 20+ also supports this via the crypto module with the same API.

// which signature algorithm to use

Ed25519 vs ECDSA vs RSA

All three produce digital signatures. They differ in key size, performance, and security assumptions. For new systems, the choice is usually clear.

Algorithm	Key size	Signature size	Use when
Ed25519	32 bytes public	64 bytes	New systems. Default for SSH, age, Signal, Nostr. Deterministic signatures (no random nonce = no Sony PS3 class of bugs).
ECDSA (P-256)	32-33 bytes public	64-72 bytes (DER)	Target runtime supports P-256 but not Ed25519 (many HSMs, older TLS stacks). JWTs with `ES256`.
RSA-PKCS1	256-512 bytes (2048-4096 bit)	256-512 bytes	Legacy systems requiring RSA. JWTs with `RS256`. TLS certificates (ECDSA preferred now).
RSA-PSS	Same as RSA-PKCS1	Same	RSA with probabilistic padding required. JWTs with `PS256`. More secure padding than PKCS1.

If you are designing a new system with no external constraint forcing another choice — use Ed25519. Smaller keys, smaller signatures, faster operations, deterministic, and no elliptic curve parameter choices that could be subverted.

// handling API keys and secrets in your dev workflow?

Septim Vault stores API keys, tokens, and .env values encrypted in-browser with AES-256-GCM — the same care we apply to cryptographic verification, applied to your dev secrets. Your vault data never leaves your device. $29 once, you keep it.

Septim Vault — $29 once →