ECDSA verify
Check a file against an ECDSA signature, on your device.
Runs on your device. The file is never uploaded.
ECDSA verify takes your file, a hex signature, an SPKI public key and the curve that key was built on, then prints valid or invalid. Hex with an odd digit count is refused outright. The curve is never read from the key, so naming the wrong one stops the run at key import instead of reporting invalid.
Questions
What do I need to check a signature?
Three things plus a setting: the file, the signature as hex, the public key as an SPKI PEM, and the curve the key was generated with. The curve must match the signing side, P-256, P-384 or P-521, because it sets both the key import and the hash. The result is "valid" or "invalid", with nothing else reported.
Why is a good signature reported invalid?
Check the curve first, since a P-384 key verified as P-256 fails at import. Then check the file is byte-identical to what was signed, because a re-save or a changed line ending is enough to break it. Then check the signature was pasted whole and the public key comes from the same pair. All of these produce the same "invalid".
What signature encoding does it take?
Hex with an even number of digits, otherwise it refuses with "signature must be a hex string with an even number of digits". The bytes go straight to crypto.subtle.verify, so it expects the raw form Web Crypto uses, which is what ECDSA sign on this site produces. A DER-encoded signature from an OpenSSL-style tool has to be converted first.
Does valid mean I can trust the file?
It means the file, the signature and the public key agree. It says nothing about who owns that public key, when the signature was made, or whether the key was later revoked. None of that exists in this tool. Establishing that a key belongs to someone is a separate problem that this page does not solve.
Do I need the private key to verify?
No. Verification uses the public key only, the BEGIN PUBLIC KEY block from ECDSA key pair generate. Do not paste a private key here; it would not import for verify in any case. The whole run happens in a Web Worker in this tab, with nothing uploaded and nothing stored.