Why ECDSA.com?
ECDSA signs most of the modern internet: TLS, SSH, JWTs, passkeys, Bitcoin and Ethereum. When a signature refuses to verify, the reason is rarely obvious — a DER signature where raw r‖s was expected, the wrong hash, the wrong curve, a high-S value, a message hashed twice. And what you need to paste to debug it — keys, tokens, certificates — is exactly what you would rather not send anywhere.
ECDSA.com is a free Lab of 91 tools in 10 categories, from signatures and JWTs to certificates, TLS, DKIM, Web3, post-quantum, passkeys, code signing and OpenPGP. Paste your material, and the tool detects the curve, format and encoding, checks it, and explains what is actually wrong — not just valid or invalid. 64 of the tools run entirely in your browser; the rest look up public data and say on their page exactly what they send. No account, no paywall, no trial.
How the Lab works
Built like a workbench, not a web service: the page is the whole machine.
Paste your material
A public key, a JWT, a certificate, a stubborn signature — whatever refuses to verify. No sign-up, no upload button.
Analyzed in your browser
Curves, formats and encodings are detected automatically and checked right in the tab. Your keys and signatures stay on your device.
An answer, with the why
Not just valid or invalid: the tools test the usual mismatch causes and explain what actually broke, in plain language.
Take it further
Run the same checks from scripts and CI through the free API, hand them to your AI assistant over MCP, or scan a repository and grade a domain.
From code, CI and AI agents
The checks behind the tools also answer your scripts, pipelines and assistants — free, and without an API key.
Free REST API
Verify ECDSA signatures and JWTs, convert DER ⇄ raw, decode certificates and grade a domain — plain JSON over HTTPS, 60 requests a minute per IP, CORS open.
MCP server
Point Claude Code, Cursor, VS Code or any MCP client at one address, and signature checks, JWT and certificate decoding, domain grades and reference lookups become tools your assistant can call. No key needed.
Repository scanner
npx ecdsa-scan . finds every place your code signs or verifies, and what is subtly wrong there — in JavaScript, TypeScript, Python and Go. Findings are graded by confidence, with SARIF and JSON output for GitHub Code Scanning and Bitbucket Pipelines.
Ready for the post-quantum transition
NIST's draft transition plan deprecates RSA-2048 and P-224 after 2030 and disallows classical signatures — ECDSA, EdDSA and RSA — after 2035. Meanwhile, TLS certificate lifetimes shrink to 47 days by 2029. ECDSA.com shows where you stand.
PQC Migration Planner
Answer ten questions about your stack and get a prioritized migration plan against the NIST draft timeline. Built locally in your browser, exportable as Markdown or PDF.
Domain Signature Health
One scan checks a domain's certificate chain, key and signature algorithms, protocol versions, lifetimes and post-quantum readiness — graded A+ to F, with a badge for your README.
Expiry alerts and My domains
Get an email before a domain's certificate expires, and keep a watchlist of up to 25 domains with grades and expiry dates in your browser.
核心功能
91 Free Tools in 10 Categories
Signatures, JOSE & JWT, certificates and keys, TLS & DNS, email (DKIM), Web3, post-quantum, identity and passkeys, code and document signing, and OpenPGP — no account, no paywall, no trial.
Local-First by Design
64 of the 91 tools run entirely in your browser and send nothing. The rest look up only public data and say on their page exactly what they send.
Failures Explained
Curves, formats and encodings are detected automatically. When a signature fails, the tools test the usual causes — wrong hash, wrong curve, DER vs raw, high-S — and explain what broke.
Free API and MCP Server
Verify signatures and JWTs, convert formats, decode certificates and grade domains from scripts and CI over plain JSON, or from AI assistants over MCP — no key needed.
Repository Scanner for CI
npx ecdsa-scan . finds signing mistakes in JavaScript, TypeScript, Python and Go, grades them by confidence and outputs SARIF for code scanning. Only confirmed findings fail a build.
Post-Quantum Readiness
A 10-question migration planner against the NIST draft timeline, Domain Signature Health grades from A+ to F with README badges, and certificate expiry alerts by email.
Learn and keep up
Beyond the tools: reference material, a course and research — all free.
- Signatures by Hand — a free 7-lesson course: compute ECDSA yourself, then sign and verify on P-256
- A reference library: glossary, real library error messages with causes and fixes, how-to recipes with working code, comparisons
- The State of Signatures on the Web — a monthly TLS report on the web's busiest domains, with open data
- This Week in Signatures — a weekly newsletter on certificate incidents, signature CVEs and post-quantum news
- Practical guides, from JWT verification mistakes to post-quantum migration
应用场景
- Debugging a signature or JWT that won't verify
- Checking the certificates and TLS setup of your domains
- Gating CI on signing mistakes in your code
- Planning the move to post-quantum signatures
Frequently asked questions
Q.Is it really local?
Yes, for everything you paste into a tool: 64 of the 91 tools verify, decode and convert inside your browser tab and send nothing. The rest have to look up public data — a domain, a URL, an address — and each says on its page exactly what it sends. None of them ever needs a private key.
Q.Why trust these tools?
Mostly, you don't have to: your keys, tokens and signatures stay on the page. Beyond that, the tools build on standard primitives and are tested against reference test vectors, including deliberately invalid ones.
Q.What are the NIST deadlines?
NIST IR 8547, still an initial public draft, plans to disallow classical signatures — ECDSA, EdDSA and RSA — after 2035, in favor of post-quantum algorithms such as ML-DSA. One step comes earlier, and only for the weakest parameter sets: RSA-2048 and P-224 are deprecated after 2030. P-256, P-384 and RSA-3072 have no 2030 milestone.
Q.Do you store anything?
Nothing you paste into a tool. ECDSA.com keeps only what you send on purpose: your email address if you subscribe to the newsletter or to certificate expiry alerts, and scan results of public domains, cached for an hour.
Q.Which curves are supported?
The NIST curves P-256, P-384 and P-521, plus secp256k1, used by Bitcoin and Ethereum, with SHA-256/384/512. For JWTs: ES256, ES384 and ES512. Both signature encodings, ASN.1 DER and raw r‖s, are detected automatically.
Q.Can I use it from code or an AI assistant?
Yes. The free REST API needs no key and allows 60 requests a minute per IP. AI assistants such as Claude Code, Cursor or VS Code connect to the MCP server, also without a key. The repository scanner runs with npx — no install, no account.
Q.What's coming next?
The Lab stays free. Around it, a platform is being built: the repository scanner is available now, a signing inventory across keys and environments is in development, and read-only runtime monitoring is planned. Paid plans are not open yet; for now there is only a waitlist.
准备好开始了吗？
探索我们的产品，或联系我们了解更多。