1. Information that you paste here, including signatures and keys, whether secret, private or public, never leaves your browser. Information from the decoding also stays in the browser. Nothing gets posted to a server. Still, you should take care. It's good hygiene to never send private information, production private keys, or provate credentials to a site you do not own and manage.
2. This tool uses EcmaScript v9, and webcrypto; it will run only on modern, current browsers.
3. For generating and verifying HTTP Signature, this page supports rsa-sha256, hmac-sha256, or hs2019 with rsa or hmac variants.
4. To generate:
   1. paste in the headers in the upper left textarea.
   2. select an algorithm in the dropdown.
   3. specify an appropriate key.
   4. click the right arrow.
5. To verify:
   1. paste in the headers in the upper left textarea.
   2. select an algorithm in the dropdown.
   3. specify an appropriate key.
   4. paste in your full Signature header in the lower right textarea.
   5. click the checkmark icon.
6. On initial page load, the browser will generate a new RSA keypair and insert it into the appropriate boxes. It also loads some contrived fixed headers. You can replace either or both with your own values.
7. You can generate a new asymmetric keypair by clicking the key button.
8. When specifying the symmetric key, you need at least 32 bytes of key material for hmac-sha256, whether signing or verifying. The PBKDF2 will generate keys of the appropriate size. If you choose a different coding system, you need to ensure minimum key size yourself.
9. This page does not explicitly handle the special values like (target-request), (created), or (expires). I may extend the page in the future to support some or all of those.
10. When using hs2019 with RSA, this page uses a salt length of 64 bytes. The specification doesn't mention the salt length, and the Signature header doesn't provide a way to specify that, so we use the convention of a salt of the same length as the output hash. This convention is explicitly specified by RFC 7518 (JWS) but is not specified by HTTP Signature.

This page uses the webcrypto for key derivation, generation, signing and verification. It also uses Bootstrap 4.0 for styling, the Open Iconic fonts for button symbols, and jQuery for interactivity.

This was written by DinoChiesa. Contact me with questions, suggestions, or kudos via Twitter.