Browser signing trusts this page's origin with your key and password. For high-value keys, use an authenticated local release or the command line tool.

Keys

Signing key

The private key is held only by this tab's isolated worker and is never stored by the browser. Key files are PQSE 3 (Argon2id, AES-256-GCM) and work with the command line tool. Locking or closing the tab discards it.

No signing key unlocked.

Verification key

Obtain the public key or its full fingerprint from the signer through a trusted channel.

No public key selected.

Sign Detached

Select a file or plain text, review its digest and the signer, then sign. The .qsig does not include the filename or time.

Review Before Signing

WAITING

Only this exact digest will be signed, with this key.

Select input and unlock a signing key.
No signature created yet.
Command line alternative

The same key files and signatures work with the local Node.js 26+ tool (OpenSSL). From a verified copy of the source:

node src/native/cli.mjs keygen --secret signer.pqse --public signer.pqpk
node src/native/cli.mjs hash --file document.bin
node src/native/cli.mjs sign --secret signer.pqse --file document.bin --expect-sha3-512 REVIEWED_DIGEST --out document.qsig

Neither implementation has FIPS module validation. Authenticate the downloaded source or release before use.

Verify Detached Signature

Select original file or plain text and .qsig. Verification uses loaded public key and/or embedded key from signature.

Review Before Verification

WAITING

Review original input digest and signer metadata before running verification.

Select original input and a .qsig file.