OstrichSign

secp256k1 · SAG ring signatures

Prove that someone in a group signed a message — without revealing who. Build a ring of Nostr public keys, sign anonymously with any member's private key, and let anyone verify the signature came from the ring.

0 identities ring: 0 no signature

01Identities & RingOrder matters — the ring is verified in this exact sequence.

Build your ring any one way — import keys you already have, or generate fresh ones. You don't need to do both.

Import existing keys

or generate your own

Public-key format

No identities yet. Import a key above, or generate one — each generated key is a keypair you control. Tick the ones to include in the ring, then choose one to sign as.

02Sign AnonymouslyNo signer selected yet.

Message

03VerifyAnyone can run this — no private keys required.

Signature (ringX…)

Message Ring — one public key per line, exact same order

Pure-JS reimplementation of the nostringer-rs scheme — SAG ring signatures over secp256k1 — with NIP-19 key import (npub/nsec) whose bech32 matches the official spec vectors. All cryptography runs in your browser; no keys ever leave this page. The ringX serialization is internally consistent but not byte-compatible with the upstream crate, and — like the original — this is experimental, unaudited code for learning, not production.