RSA-PSS verify
Check a file against an RSA signature (RSA-PSS/SHA-256), on your device.
Runs on your device. The file is never uploaded.
RSA-PSS verify checks a file against a hex signature and an SPKI public key, then prints valid or invalid and nothing else. A signature that is not hex, or that has an odd digit count, is turned away. Valid covers those three inputs alone: it names nobody, dates nothing and checks no revocation.
Questions
What does the result mean?
The tool prints "valid" or "invalid" and nothing else. "valid" means this exact file, this signature and this public key agree under RSA-PSS with SHA-256 and a 32-byte salt. It does not mean the key belongs to any particular person or organisation. Deciding whose key it is sits entirely outside this tool.
Why does a signature I know is right come back invalid?
Usually the bytes changed. Verification covers the whole file as dropped, so a re-saved copy, converted line endings or an added trailing newline breaks it. The other common causes are the wrong public key, a key made with purpose=encrypt instead of sign, and a signature copied with a character missing. Nothing distinguishes these cases; all of them print "invalid".
What format is the signature?
Hex with an even number of digits, pasted as text into the signature option. Anything else is refused with "signature must be a hex string with an even number of digits". That is exactly what RSA-PSS sign produces. A base64 signature from somewhere else has to be converted to hex first.
Can it verify a PKCS#1 v1.5 signature?
No. The scheme is fixed at RSA-PSS with SHA-256 and a 32-byte salt. A PKCS#1 v1.5 signature over the same file with the same key returns "invalid" here. It also does not read a signature container, a PGP signature or a signed PDF; it takes raw hex and raw file bytes only.
Do I need the private key?
No, and you should not paste one. Verification takes the public key as an SPKI PEM, the BEGIN PUBLIC KEY block from RSA key pair generate with purpose=sign. A public key is meant to be published; that is the point of it. Everything runs in a Web Worker in this tab either way, and nothing is uploaded.
Does invalid mean the file was tampered with?
It means the three inputs do not agree, and that is all it can tell you. A tampered file gives "invalid", but so does the wrong key, a mistyped signature, or the same file saved in a slightly different form. Treat "invalid" as a reason to check each of the three inputs, not as proof that someone changed something.