RSA-PSS sign
Sign a file with an RSA private key (RSA-PSS/SHA-256), on your device.
Runs on your device. The file is never uploaded.
RSA-PSS sign signs the whole file under RSA-PSS, hashing with SHA-256 and salting each signature with 32 fresh bytes. The salt changes every run, so signing one file twice gives two hex strings that both verify. Nothing else is bound in: no timestamp, no signer name and no file name travels with it.
Questions
What signature scheme is this?
RSA-PSS with SHA-256 and a 32-byte salt, through crypto.subtle. All three are fixed: there is no option to change the hash, the salt length, or to produce a PKCS#1 v1.5 signature. The private key must be a PKCS8 PEM from RSA key pair generate with purpose set to sign. An RSA-OAEP key from the encrypt setting will not import here.
What exactly gets signed?
The whole file, byte for byte, as dropped. The tool does not canonicalise the content, strip whitespace, or include the filename or a timestamp. Change one byte and the signature no longer verifies. That also means a file that gets re-saved, re-encoded or has its line endings converted will fail verification even though it looks the same on screen.
What do I do with the output?
It is the signature as a hex string on the page. Copy it and give it to RSA-PSS verify along with the same file and the matching public key. There is no detached signature file format here and no container. The signature is as long as the modulus, so 256 bytes and 512 hex characters for a 2048-bit key.
Why is the signature different each time?
PSS uses a fresh random salt for every signature, 32 bytes in this tool. Signing the same file twice with the same key gives two different hex strings, and both verify. Do not treat a signature as a fingerprint of the file; use Generate all hashes or a dedicated hash tool for that.
Does signing prove when the file was made?
No. A signature proves only that whoever held the private key signed these exact bytes. There is no timestamp, no signer name and no revocation check anywhere in this tool. Anyone with the private key can produce the same kind of signature at any time, and nothing in the output says when it happened.
Where does the private key go?
Into the page and nowhere else. The PEM is decoded and imported by crypto.subtle in a Web Worker in this tab, non-extractable, and dropped when the run ends. Nothing is uploaded and the site works offline. Whether to paste a real private key into a browser tab at all remains your call.