What input does RSA Signer accept?

RSA Signer accepts text. Sign a plaintext message with a PEM encoded RSA key.

Which settings does RSA Signer provide?

RSA Signer provides controls for RSA Private Key (PEM), Key Password, Message Digest Algorithm.

What does RSA Signer return?

RSA Signer returns text. Sign a plaintext message with a PEM encoded RSA key.

RSA Signer | Tool Factory

Tool workspace

Your input stays in this browser.

Needs input

Run the tool when your input is ready.

Message

Options

Message format

Signature format

RSA Private Key (PEM)

Key Password

Message Digest Algorithm

Your result appears here

Process key or token data with RSA Sign and explicit format settings. Enter the key material, choose the required format, then review the result.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

RSA Signer signs message bytes with an RSA private key using RSASSA-PKCS1-v1_5 and SHA-256, SHA-384, or SHA-512. It returns the signature in Base64 or Hex. It does not create RSA-PSS signatures.

The result is the signature in Base64 or Hex. Its length equals the key modulus: 256 bytes for a 2048-bit key. The same key and message always give the same signature.

Create a signature to test another system's PKCS#1 v1.5 verifier.
Sign a small release note or license string with a test key.
Show that PKCS#1 v1.5 signing is deterministic for a fixed key and message.

Sources: RFC 8017: RSASSA-PKCS1-v1_5 signature scheme

Instructions

Enter the message and set Message format to UTF8, Hex, or Base64. The tool signs the decoded bytes.
Paste the RSA private key PEM. Enter Key Password only when the key is encrypted.
Keep Message Digest Algorithm SHA-256 unless the verifier requires SHA-384 or SHA-512.
Choose Signature format Base64 or Hex, then select Sign.
Send the signature, the exact message, and the digest name to the verifier.

Example

Input: Hello

Settings: RSA Private Key (PEM) from a new 2048-bit test pair; Key Password empty. Message format UTF8; Message Digest Algorithm SHA-256; Signature format Base64.

Result: A 344-character Base64 signature that decodes to 256 bytes. A different key gives a different signature.

PKCS#1 v1.5 signing is deterministic. The same key and message always give the same signature.

Limits

Only RSASSA-PKCS1-v1_5 is supported. RSA-PSS signatures, such as JWT PS256, cannot be created or verified.
Any byte change breaks verification. A trailing newline from echo is a common cause; sign with printf instead.
Base64 input must be padded standard Base64. Base64url from JWTs is rejected until you convert it.
SHA-1 appears only as a legacy verification choice. New signatures use SHA-256, SHA-384, or SHA-512.
Limits: the message can be 1 MiB, a PEM key 64 KiB, and a decoded signature 16 KiB.
Verified OK proves that the key matches. It does not prove who owns the key. Get the public key from a trusted source.