Signature Validator

WHAT IT DOES

Signature Validator is a cryptographic tool that verifies ECDSA signatures and recovers the signer's address from any signed message. Enter a message, the signature (hex string), and optionally the expected signer address — the tool computes the message hash, recovers the signer from the signature, and compares it to the expected address (if provided). It supports both raw message hashing (Keccak256 of the UTF-8 encoded message) and Ethereum's personal_sign format (the standard "\x19Ethereum Signed Message:\n" prefix). This is essential for developers testing signature verification, validating signed messages from users, debugging authentication flows, or checking the integrity of signed data in smart contracts.

HOW TO USE

Connect your wallet using the BGWallet bridge (MetaMask or any Web3 wallet). Enter the original message that was signed (plaintext). Enter the signature as a hex string (0x + the signature bytes — typically 130 characters for an ECDSA signature). Optionally, enter the expected signer address to verify that the signature matches a specific address. Select the message format: "Raw message" (no prefix, just Keccak256 of the UTF-8 bytes) or "personal_sign" (Ethereum's standard signed message format with prefix). Click "Validate signature" to perform the verification. The tool displays the message, signature, recovered signer address, expected signer (if provided), and a status badge indicating whether the signature is valid. If no expected signer is provided, the tool simply recovers and displays the signer address.

TECHNICAL MECHANISM

The tool uses ethers.js cryptographic utilities to perform signature recovery. For raw messages, it computes the message hash using ethers.utils.keccak256(ethers.utils.toUtf8Bytes(message)). For personal_sign messages, it uses ethers.utils.hashMessage(message), which applies the Ethereum signed message prefix ("\x19Ethereum Signed Message:\n" + message length + message) before hashing. It then uses ethers.utils.recoverAddress(messageHash, signature) to recover the ECDSA public key and derive the Ethereum address that signed the message. If an expected signer address is provided, the tool compares the recovered address to the expected address (case-insensitive) and reports whether they match. The recovered signer is always displayed, giving you the ability to verify signatures even without knowing the signer in advance. All computation is performed client-side — no external APIs or network calls are required for the signature validation itself.

WHAT IT CANNOT SEE

The tool cannot validate signatures for messages that were not signed using EVM-compatible signing schemes (ECDSA, personal_sign, eth_signTypedData). It cannot recover signers for messages signed with non-standard or custom signature formats (e.g., Ed25519, BLS, or other curve signatures). It cannot validate signatures off-chain without the original message being provided — the original plaintext must be supplied to compute the correct hash. It cannot verify signatures that require external data not present on the chain — for example, signatures that include nonces, expiration timestamps, or chain IDs not provided in the message. It cannot verify EIP-712 typed data signatures without the full typed data structure and domain separator. It cannot detect forged or invalid signatures beyond the cryptographic verification — a recovered address is always produced, but the tool cannot determine if the signature was produced maliciously. The tool is read-only and does not sign any transactions.

PLEASE NOTE

This tool works exclusively with EVM-compatible signatures (ECDSA). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP use different signature schemes and are not supported. The message format must match the format used when the signature was created — using the wrong format will produce a different hash and fail to recover the correct signer. The tool does not store any data — all operations are performed client-side. The tool is provided as-is with no warranty or liability. Always verify that the message content matches what you expect before validating signatures.