ECDSA Key Generator, Sign and Verify Online
Generate ECDSA key pairs, sign messages and verify signatures on secp256k1, P-256, P-384 and P-521 in your browser. SHA-2, SHA3-256 or Keccak-256 hashing, DER or compact signatures, deterministic RFC 6979. Nothing is uploaded.
About the ECDSA Tool
The ECDSA Tool generates elliptic-curve key pairs, signs messages and verifies signatures with the Elliptic Curve Digital Signature Algorithm. It supports four curves: secp256k1, P-256, P-384 and P-521. Keys and signatures are shown in hex, so you can paste them into code, compare them with the output of OpenSSL or a wallet library, or check a test vector by hand. Everything runs in your browser; your keys and messages are never uploaded.
How to use it
Generate keys
- Pick a curve. secp256k1 is selected by default.
- Press Generate key pair. The private key is drawn from your browser's cryptographically secure random number generator, and the public key is derived from it.
- Turn off Compressed public key to see the uncompressed point, which starts with
04. - To derive the public key of a key you already have, paste the private key in hex. The public key updates as you type.
Sign
- Open the Sign tab and paste the private key, or keep the one you just generated.
- Type the message, or turn on Message is hex and paste its bytes.
- Choose the hash and the signature format. The signature appears straight away, with a Copy button.
Verify
- Open the Verify tab and paste the public key, compressed or uncompressed.
- Enter the same message and hash that were used to sign.
- Paste the signature. DER and compact signatures are detected automatically, and the page reads Signature is valid or Signature is NOT valid.
Privacy
Key generation, signing and verification happen entirely in your browser. Private keys, messages and signatures are never sent to our servers, and nothing is kept once you close or reload the tab. Even so, treat a private key that controls real funds or production systems with care: generate such keys offline, on a device you trust.
Which curve to use
secp256k1
secp256k1 is the curve of Bitcoin, Ethereum and most other blockchains. Its private keys are 32 bytes and its compressed public keys 33 bytes. Signatures made here are normalised to low-S, the form those networks require.
P-256, P-384 and P-521
The NIST curves from FIPS 186-5 are the ones TLS certificates, WebAuthn passkeys, JSON Web Tokens (ES256, ES384, ES512) and smart cards use. P-256 is by far the most common; P-384 and P-521 give larger security margins at the cost of longer keys and signatures. P-521 really is 521 bits, so its private keys are 66 bytes.
Why the message is hashed
ECDSA signs a number no larger than the curve order, not an arbitrary message. The message is therefore hashed first, and the digest is what gets signed. Signer and verifier must use the same hash, or a correct signature will fail to verify. The usual pairings are SHA-256 with secp256k1 and P-256, SHA-384 with P-384 and SHA-512 with P-521. Ethereum uses Keccak-256, the original Keccak submission, which differs from the standardised SHA3-256 in its padding, so both are offered. When a digest is longer than the curve order, ECDSA keeps only its leftmost bits, as the standard specifies.
Signature formats
- DER is the ASN.1 encoding
SEQUENCE { INTEGER r, INTEGER s }, starting with30. OpenSSL, Java, .NET, X.509 certificates and Bitcoin transactions use it. Its length varies by a few bytes. - Compact is
rfollowed bys, each padded to the curve size: 64 bytes on secp256k1 and P-256, 96 on P-384 and 132 on P-521. JSON Web Tokens and Web Crypto use it.
Deterministic signatures
ECDSA needs a fresh secret number k for every signature, and a repeated or predictable k reveals the private key. This tool derives k from the private key and the message digest as RFC 6979 describes, so signing the same message with the same key always gives the same signature, and no random number generator can fail you. Other libraries may use a random k; their signatures look different but verify just the same.
OpenSSL equivalents
- Generate a key:
openssl ecparam -name secp256k1 -genkey -noout -out key.pem(useprime256v1for P-256). - Sign a file with SHA-256:
openssl dgst -sha256 -sign key.pem -out sig.der message.txt. The result is a DER signature;xxd -p sig.derprints it in hex. - Verify:
openssl dgst -sha256 -verify pub.pem -signature sig.der message.txt.
Related tools
For RSA keys, signatures and encryption, use the RSA tool. To hash a message on its own, the Hash Generator computes SHA-256 and SHA-512, and the Hash Calculator adds SHA-3 and Keccak-256. To inspect an ES256 token, open the JWT Decoder. For random secrets that are not key pairs, try the Password Generator.
Open-source credits
- Curve arithmetic, key generation and RFC 6979 signing use @noble/curves by Paul Miller, MIT licence.
- Message hashing uses @noble/hashes by Paul Miller, MIT licence.
- Random private keys come from the browser's built-in Web Cryptography API.
- The algorithms follow NIST FIPS 186-5 (Digital Signature Standard), SEC 2 (Recommended Elliptic Curve Domain Parameters) for secp256k1 and RFC 6979 (Deterministic Usage of DSA and ECDSA). The tests use the RFC 6979 appendix A.2.5 vector.
Frequently asked questions
Why does my signature differ from the one another library made?
ECDSA allows many valid signatures for the same message and key. This tool uses deterministic RFC 6979 nonces, so it always gives the same signature, while some libraries pick a random nonce each time. Signatures can also differ in encoding, DER or compact, and in whether s is normalised to low-S. All of them verify against the same public key.
What is the difference between a compressed and an uncompressed public key?
An uncompressed key holds both coordinates of the curve point and starts with 04. A compressed key holds only the x coordinate and a prefix of 02 or 03 that says which of the two possible y values is meant. Both describe the same key; the compressed form is about half the size.
Which hash should I pick?
Use whatever the system that checks the signature expects. SHA-256 is the default for secp256k1 and P-256, SHA-384 pairs with P-384 and SHA-512 with P-521. Ethereum signs Keccak-256 digests, which are not the same as SHA3-256. A signature verifies only with the hash it was made with.
Is it safe to generate a private key in a browser?
The key comes from the browser's cryptographically secure random number generator and never leaves your device. For keys that will protect real funds or production systems, generating them on an offline machine or a hardware device is still the safer habit, because a compromised browser or extension could read the page.
Can I use these keys with OpenSSL?
Yes. The signatures are standard ECDSA and the DER format is what openssl dgst -sign produces and -verify expects. OpenSSL stores keys in PEM files rather than raw hex, so convert the key format with a library or OpenSSL's own tools when moving keys between them.