Signature Inspector

Most "401 from Mastodon" bugs come down to the signer and the verifier building different strings. Paste a signed request exactly as it arrived (or as your code sends it) to see the string that was actually signed, whether the body digest matches, and whether the signature covers what Mastodon requires. Then paste the sender's public key to verify it.

Raw HTTP requestRequest line, headers, a blank line, then the body, exactly as received. Runs entirely in your browser.

Target URI (RFC 9421 only, optional)Defaults to https:// + Host + request path.

How it works

The tool detects the scheme from the headers:

Header present	Scheme	What it builds
Signature-Input	RFC 9421	The signature base (§2.5) for the first label: derived components (@method, @target-uri, @authority, @scheme, @request-target, @path, @query, @query-param) and header fields, then @signature-params. Checks Content-Digest (RFC 9530) when it is covered.
Signature only	draft-cavage-12	The signing string from the headers parameter (default date), with (request-target) including the query string as Mastodon builds it. Checks the legacy Digest header.

The Mastodon checks are the exact conditions in signed_request.rb (Mastodon 4.7.3): draft-cavage and RFC 9421. For draft-cavage, the signature must cover date or (created), (request-target) or digest, host on GET, and digest on POST. For RFC 9421, it must have created and keyid parameters and cover @method and @target-uri, plus content-digest on POST.

Verification uses your browser's WebCrypto: RSA keys as RSASSA-PKCS1-v1_5 with SHA-256 (rsa-sha256 / rsa-v1_5-sha256), and Ed25519. Ed25519 needs a current browser. RSA-PSS, ECDSA and HMAC aren't supported. The signature base logic is tested against the RFC 9421 Appendix B test vectors, including verifying the B.2.6 Ed25519 signature (tests in tests/tools in the site repository).

:::tip Common mismatches the string shows immediately

• A Digest computed over re-serialised JSON instead of the exact bytes sent
• (request-target) missing the query string, or using the wrong case for the method
• A header in the headers list that a proxy changed or dropped (often host)
• Date in the wrong format, or too old. Mastodon accepts a signature for about an hour (5 minutes plus 1 hour of clock skew) unless an explicit expiry says otherwise. :::

For how verification should work end to end, see Verifying incoming requests and HTTP signatures in 2026.