How to Open a SIG File

What is a SIG file?

A .sig file is, in the vast majority of real-world cases, an OpenPGP detached signature (defined in RFC 4880) — a small cryptographic proof, separate from the file it signs, that lets anyone confirm the file came from the claimed source and hasn't been modified since. It's the mechanism behind "verify this download" instructions on Linux distribution sites, GitHub release pages, and open-source project downloads generally.

Structurally, a signature file contains one or more OpenPGP Signature packets: a version number, the signature type (whether it signs a binary file or text), the public-key algorithm and hash algorithm used, a timestamp, and the signer's key ID or fingerprint — all of which are readable without needing any cryptographic key, which is exactly what this page's tool decodes. The actual proof of authenticity is a large number (the signature value itself) that can only be meaningfully checked against the original file and the signer's real public key, using dedicated software like GPG.

A .sig file comes in two forms: binary (compact, starts with a byte that has its high bit set) or ASCII-armored (starts with the text -----BEGIN PGP SIGNATURE-----, safe to paste into an email or web page). Both encode exactly the same underlying data — armor is just a base64-with-checksum text wrapper around the same binary packet.

How to verify a SIG file on Windows

1. Install Gpg4win (free, gpg4win.org), which includes GPG and a Windows-friendly interface.
2. Import the signer's public key: gpg --import theirkey.asc, or fetch it from a keyserver with gpg --recv-keys KEYID.
3. Open Command Prompt or PowerShell in the folder with both files, and run gpg --verify file.sig file (use the actual filenames).
4. Look for "Good signature" in the output — anything else means it failed to verify.

How to verify a SIG file on Mac

1. Install GPG via Homebrew (brew install gnupg) or the GPG Suite app.
2. Import the signer's public key the same way as on other platforms: gpg --import theirkey.asc.
3. Open Terminal in the folder with both files and run gpg --verify file.sig file.

How to verify a SIG file on Linux

1. GPG is pre-installed on almost every distribution; if not, install the gnupg package from your package manager.
2. Import the project's public key, often provided as a link on their download page: gpg --import key.asc, or gpg --recv-keys KEYID --keyserver keyserver.ubuntu.com.
3. Run gpg --verify file.sig file in the folder containing both files.

Common SIG file problems and how to fix them

"gpg: Can't check signature: No public key"

You haven't imported the signer's public key yet. Find it on the project's website, a keyserver, or the same download page as the signature, then import it before verifying.

"BAD signature" instead of "Good signature"

Take this seriously — it means the file doesn't match what was signed, whether from a corrupted download or genuine tampering. Re-download the file from the original source and verify again before trusting it.

GPG says the signature is good, but shows a warning about trust

This is normal and different from a bad signature: GPG is only saying it can't independently vouch for whether the key really belongs to who it claims, not that the file is wrong. The cryptographic match itself ("Good signature") is what confirms the file wasn't altered.

Related file extensions

Technical references

When a .sig file is an OpenPGP signature, its structure is defined by the IETF's OpenPGP standard — currently RFC 9580, which superseded the older RFC 4880 in 2024.

• RFC 9580 — OpenPGP — The current IETF standard defining the OpenPGP message and signature format (supersedes RFC 4880).

Frequently asked questions