ML-DSA (Dilithium) Digital Signature Demo
Try ML-DSA (Dilithium, FIPS 204) in your browser: generate keys, sign a message, verify the signature and see the key and signature sizes against Ed25519.
How to use ML-DSA (Dilithium)
- 1Pick a parameter set (ML-DSA-65 is the usual choice) and press Generate key pair.
- 2Type a message, optionally add a context string, and press Sign to get the signature as Hex or Base64.
- 3Paste the public key, message and signature into Verify: you get Valid, or Invalid if anything was changed.
What makes it better
- ML-DSA-44, ML-DSA-65 and ML-DSA-87 as standardised in FIPS 204
- Generate, Sign and Verify with an optional context string
- Keys and signatures as Hex or Base64 with Copy and Download
- Key and signature sizes shown against Ed25519 and RSA-3072
- Runs in your browser with a pure-JavaScript library: nothing is uploaded
About ML-DSA (Dilithium)
ML-DSA, formerly Dilithium, is the NIST-standard digital signature scheme built to resist quantum computers. You sign a message with a secret key and anyone with the public key can check that the signature is genuine and the message is unchanged. This demo runs ML-DSA-44, 65 and 87 in your browser and shows how large the keys and signatures are.
Common uses
- See how post-quantum signatures behave before planning a migration of code-signing or document-signing.
- Measure the larger signature and key sizes to size certificates, tokens or firmware headers.
- Create sample signatures to test your own ML-DSA verifier or compare against another library.
- Show students that changing one character of a signed message makes verification fail.
Example
Input
ML-DSA-65
Result
ML-DSA-65: public key 1,952 B · secret key 4,032 B · signature 3,309 B
Good to know
- ML-DSA is NIST-standardised (FIPS 204, August 2024). Real systems often pair it with a classical signature in a hybrid arrangement while the ecosystem matures.
- Browsers do not expose ML-DSA through Web Crypto yet, so this page uses an audited pure-JavaScript library (@noble/post-quantum). Key generation here is not hardware-backed.
- These are demo keys: do not use them to protect real data or identities. A valid signature only proves the message matches this public key, not who owns it.
ML-DSA (Dilithium) FAQ
What is ML-DSA and how does it relate to Dilithium?
ML-DSA is the standardised form of CRYSTALS-Dilithium, published by NIST as FIPS 204. It is a lattice-based signature scheme believed to resist quantum attacks. Because details changed in standardisation, old Dilithium signatures do not verify as ML-DSA.
Which ML-DSA parameter set should I choose?
ML-DSA-65 is the general-purpose recommendation. ML-DSA-44 gives smaller keys and signatures at a lower security level, and ML-DSA-87 gives the strongest margin at the largest size. Signer and verifier must use the same set.
What is the context string for?
FIPS 204 lets a signature be bound to a short label such as an application name. A signature made with context invoice-v1 will not verify with a different context, which stops it being reused in another setting. Leave it empty if you do not need it.
Why are ML-DSA signatures so large compared with Ed25519?
An ML-DSA-65 signature is 3,309 bytes and its public key 1,952, against 64 and 32 for Ed25519. Lattice signatures need that extra data for their security. It matters most for protocols that send many signatures, such as certificate chains.
Does a Valid result mean the message is trustworthy?
It means the signature was made with the secret key that matches the public key you pasted and the message has not changed. It does not tell you who controls that key. You still need a trusted way to learn that a public key belongs to a person or organisation.