minisign

minisign is a simple, secure tool for signing and verifying files, created by Frank Denis (jedisct1), the same developer behind libsodium. It is designed as a modern, minimalist alternative to GPG (GNU Privacy Guard) for the specific use case of file signing and verification, without the complexity, legacy cruft, and confusing interface that GPG carries from decades of feature accumulation. minisign focuses on doing one thing and doing it well: providing cryptographic proof that a file was signed by the holder of a specific private key. The tool uses Ed25519 (Edwards-curve Digital Signature Algorithm) for digital signatures and BLAKE2b-512 as the prehash function, providing strong security with excellent performance. Key features include: a simple two-key model (one public key for verification, one secret key for signing, with no complex keyrings or trust models to manage), support for signing messages with optional untrusted comments (allowing metadata like version numbers or release dates to be attached to signatures without affecting security), trusted comments that are cryptographically bound to the signature (useful for embedding the signing date or file name), support for Ed25519 and legacy EdDSA signatures, a password-protected secret key format (the private key is encrypted using a password-derived key via Argon2id or scrypt, so even if the key file is stolen, it cannot be used without the password), support for multiple signatures on the same file (allowing multiple parties to sign the same artifact for multi-party verification), and batch verification mode for verifying multiple files efficiently. minisign is used by the WireGuard project, OpenBSD, and many security-conscious software distribution pipelines. The reference implementation is written in C, with ports available in Go, Rust, and Python. As of 2026, minisign has over 1,800 GitHub stars.