Why verification matters
OpenPGP (often called PGP) lets someone prove that a piece of text or a file was signed with a specific private key, and that the content has not changed since it was signed. A signature is not a guarantee of identity by itself. It only becomes useful after you have independently confirmed that the matching public key is the one published here.
This site is a place to obtain that public key and the fingerprint printed with it. Verification itself is done in OpenPGP-compatible software on your computer or in your mail client. Nothing on this page can mark a message valid for you.
What you need
- The signed material — the email, message, or file exactly as it arrived, plus any separate signature that came with it.
- The public key — published on this site at https://www.betancour.dev/pgp.asc.
- The fingerprint — printed below. Compare it with the key you imported before treating that key as mine.
- OpenPGP software — a mail client or application that can import a public key and check a signature. Use the verify function in the software you already trust.
Obtain the key, then authenticate it
Download the ASCII-armored public key from this site, then import it into your OpenPGP software. After import, display the key’s fingerprint and compare it with the value published here. Every character must match.
Published fingerprint
7ECA 82D4 A723 BB8A C8D1 D7E0 8C27 021E 3925 261E Spacing does not change the fingerprint. Compare it in full before trusting the key.
This domain also publishes the same key through a Web Key Directory under /.well-known/openpgpkey/. That is another copy hosted here — not a second
opinion. A key retrieved automatically is still untrusted until the fingerprint matches.
How to verify
The exact clicks or commands depend on your software. The sequence does not. Follow your application’s own documentation for importing a key and checking a signature.
Keep the original
Do not retype or “clean up” the signed text. Save the email, message, or file as you received it. If a detached signature arrived beside a document, keep both files together.
Import the public key
Open the downloaded key file in your OpenPGP software, or import /pgp.asc from this site.
Compare the fingerprint
Display the imported key and check it against the published fingerprint above. If it differs, stop. Do not use that key.
Check the signature
Use your software’s verify action on the signed email, the signed message, or the file and its signature. Read the result using the meanings below — not a screenshot from someone else.
Email, messages, and files
Signed email
A signed message may carry an inline signature or a signature the mail client attaches. Open the message in software that understands OpenPGP, after the published key is imported and the fingerprint matches. If the mail client has no OpenPGP support, save the raw signed message and verify it in a separate OpenPGP application.
Signed message
A standalone signed note is usually a cleartext signed block or a short text file plus a signature. Verify that file (and the signature file, if it is separate) with the same imported key. Do not copy the text into a new document first.
Signed files or other material
If a document was signed, you should have the original file and the signature that belongs to it. Point your OpenPGP software at both. A valid result applies only to that exact file — a re-exported or converted copy will not match.
What the result means
Valid signature
The software reports that the signature matches this public key and that the content has not changed since it was signed. That is only as strong as your fingerprint check. If you skipped that check, a “valid” result only means some key you imported made the signature.
Invalid signature
The content does not match the signature, the signature is incomplete, or it does not belong to this key. Treat the material as untrustworthy. Do not assume a typing error — obtain the original again from the source.
Unknown or untrusted key
The signature may be mathematically fine, but the software does not yet treat this key as authenticated. That is the usual state after a first import. Compare the fingerprint published on this page before you assign trust in your software. Until then, do not treat the signer as verified.
Security notes
- A public key file is not an identity. The fingerprint comparison is the identity check.
- Keys copied from search engines, chat, or forwarded attachments are unauthenticated until they match the fingerprint published here.
- Web Key Directory on this domain is another distribution path for the same key. It does not replace a fingerprint check.
- This website cannot see the message you are checking and cannot produce a valid or invalid result for you.