ECDSA Sign / Verify
Sign a message with an ECDSA private key or verify an ECDSA signature with a public key. Supports P-256, P-384, P-521 and secp256k1, SHA-256/384/512, PEM or hex keys, and DER or raw signatures.
Input
Auto-detected when you paste a PEM key; used for raw hex keys.
PKCS#8 / SEC1 PEM or raw hex scalar. Never leaves your browser.
Output
More ways to use this tool
REST API
curl -X POST https://api.iotools.cloud/v1/tool/ecdsa-sign-verify \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"mode": "sign",
"message": "hello world",
"curve": "p256",
"hash": "sha256",
"signatureFormat": "der",
"signatureEncoding": "hex",
"privateKey": "000000000000000000000000000000000000000000000000…"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `ecdsa-sign-verify` tool (ECDSA Sign / Verify) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.
Embed widget
<iframe
src="https://iotools.cloud/embed/ecdsa-sign-verify/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="ECDSA Sign / Verify — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Drop this into your own page — free, no key required, just a link back.
| Cost per API/MCP call | From 5 credits |
|---|---|
| Need more credits? | View pricing |
Also available with
Guides
Sign a message with an ECDSA private key, or check an ECDSA signature against a public key — all in your browser. Works with P-256, P-384, P-521 and secp256k1, hashes with SHA-256/384/512, and reads keys as PEM or raw hex.
How to use this tool
- Pick Sign a message or Verify a signature.
- Enter the message (UTF-8 text or hex).
- To sign, paste the private key (PKCS#8 or SEC1 PEM, or a hex scalar). To verify, paste the public key (SPKI PEM, or hex in compressed/uncompressed form) and the signature.
- Choose the curve (auto-detected from PEM keys), hash, and signature format: DER is what OpenSSL produces; raw
r||sis what JWT ES256 and Web Crypto use. - Copy the result, or read "Valid signature" / "Invalid signature".
Signing is deterministic (RFC 6979), so the same key and message always give the same signature. Keys and messages never leave your browser — but for real secrets, prefer a trusted offline tool.
FAQ
Where do I get a key pair?
Use the ECDSA / Ed25519 Key Generator.
Why does verification fail with a valid-looking signature?
Usually a mismatch in hash, curve, or signature format (DER vs raw), or the message differs by a byte such as a trailing newline.
Does it interoperate with OpenSSL?
Yes — signatures made here verify with openssl dgst -sha256 -verify, and OpenSSL's DER signatures verify here.