Web3 Lab · T.08

Message Verifier

Does this statement really come from this address? Verify EIP-191 signatures — verify only, never sign, no private key needed.

Message — exactly as signed, character for character

Signature — 0x + 130 hex characters (65 bytes)

Claimed address — 0x + 40 hex characters

Examples:

Note: only the cryptographic mapping of message, signature, and address is checked — not whether the signer is trustworthy. Examples use a public demo key, no real funds.

Knowledge · EIP-191

How verification works

When signing, the wallet prepends the prefix \x19Ethereum Signed Message:\n + length to the message, hashes everything with Keccak-256, and signs with the private key. The prefix prevents a signature from accidentally being reused as a transaction.

Verification runs backwards: public-key recovery computes the signer address from message and signature and compares it to the claimed one. If they match, the holder of that key provably signed exactly this message.

Typical uses: proving airdrop eligibility, passwordless logins, checking the authenticity of announcements — and wherever AI agents sign claims: verify, don't trust.

Use the tabs above to switch standards: EIP-712 for structured typed data (domain + types + values as JSON) and Bitcoin for classic message signatures in Bitcoin Core format (Base64).

FAQ

Frequently asked questions

Do I need my private key?

No — that is the whole point. Verifying needs only message, signature, and address. This tool can exclusively verify, never sign.

What does it mean if the signature does not match?

Either the message was altered afterwards, the signature belongs to a different message, or the given address is not the signer. In all cases: do not trust.

Does this work with EIP-712 (typed data)?

Yes — choose the “EIP-712” tab and paste domain, types, and message as JSON. The standard hash of domain separator and struct hash is verified against the signature.

Which Bitcoin addresses are supported?

Legacy addresses (1…, P2PKH) and native SegWit addresses (bc1q…), each verified via public-key recovery. Taproot (bc1p…) uses Schnorr signatures (BIP340) and is not supported.

Does my input leave the browser?

No. Everything runs locally. A check can be shared via deep-link (?message=…&sig=…&address=…) — only actively sharing leaves the browser.

Address verified — but is it well-formed?

Combine the Message Verifier with the Address Validator: first check who owns a statement — then whether the address is cleanly encoded.

To the Address Validator To the Wallet Generator