Tool · Keys & addresses

Schnorr signature

Sign, verify, then flip one bit and watch it fail

Schnorr signature

Sign with the private key, verify with the public key, then break it

Private key for learning only

Message signed as SHA-256(text)

P Public key (x-only)

41a72a7b46ce0ab003c631b38d980ade640612963d3e884949a16bf961e28456

m Message digest

bcd410d351ce06c9bdfb6e0cf733d2ba1eeb2854d49d542288096232b29523ac

σ Signature: R.x ‖ s

9af473ce79bba67a44d3a7833ae89e8301f05d1705e533b8887fd36cc2c8e560b9db803321cf0aab34993413b309f4895914117da4aba9dc27b07a90b1fea960

64 bytes: the x-coordinate of a one-time point R, then the number s. Pearl’s default signer picks R deterministically (RFC 6979), so the same key and message always give the same signature.

Flip one bit in the

Signature valid

The equation s·G = R + e·P holds, so whoever made this signature knew the private key for P, and the message is exactly this one.

How verification works

The verifier never sees the private key. It recomputes a challenge number e from R, P and the message, then checks one equation on the curve:

e = TaggedHash(“BIP0340/challenge”, R.x ‖ P.x ‖ m) mod n

R.x: 9af473ce79bba67a44d3a7833ae89e8301f05d1705e533b8887fd36cc2c8e560
P.x: 41a72a7b46ce0ab003c631b38d980ade640612963d3e884949a16bf961e28456
m: bcd410d351ce06c9bdfb6e0cf733d2ba1eeb2854d49d542288096232b29523ac
e: e5e183f0c353ca76e8e0e571ef42443a2b5a4002e7d8751fafee3ec41f237715
s: b9db803321cf0aab34993413b309f4895914117da4aba9dc27b07a90b1fea960

s·G = R + e·P

Only someone who knows d (P = d·G) could have chosen s = k + e·d so that this balances, and e can’t be known before R is fixed. Signing a different message or with a different key changes e, which is why every flip above fails.

Runs in your browser · nothing is sent src/lib/keys.ts · BIP-340, Pearl’s RFC 6979 signer

What it does

Type a message and the tool signs its SHA-256 digest with the private key, then verifies the signature against the public key. Use the Flip one bit buttons to change a single bit of the message, the signature or the public key, and watch verification fail. Press a button again to undo it.

How to read it

A signature is 64 bytes: R.x, the x-coordinate of a one-time point, then the number s.
The verifier recomputes a challenge e = TaggedHash(“BIP0340/challenge”, R.x ‖ P.x ‖ m) and checks s·G = R + e·P. Open How verification works to see every value.
One flipped bit in any of the three inputs changes e (or s) completely, so the equation fails. There’s no “almost valid”.

Pearl specifics

Pearl’s transaction signatures are Schnorr (BIP-340): Pearl has no ECDSA in transactions. (XMSS, a post-quantum signature, is an opt-in extra inside tapscript.)
Pearl’s default signer picks the one-time nonce deterministically (RFC 6979, with extra data SHA-256(“BIP-340”)), so the same key and message always give the same signature. That’s what this tool uses.
Real transactions sign a TapSighash digest of the transaction, not SHA-256 of some text. The math is the same.
The key here is for learning only.

Under the hood

Runs entirely in your browser. Signing and verification are src/lib/keys.ts on top of the audited @noble/curves. Unit tests check the official BIP-340 vectors, and that the deterministic signer reproduces real Pearl signatures from the research, byte for byte.