Live · No account required

Try post-quantum signing
right now

Sign payloads with ML-DSA, test Zero-Exposure Signing, and issue Mandates — all against the live FIPSign API. Nothing is stored.

NO REGISTRATION · NO API KEY · NO CREDIT CARD

Sign a payload

Choose an ML-DSA algorithm, write any JSON payload, and sign it with the live FIPSign API. Then verify, and revoke it to see the full token lifecycle.

Token

Zero-Exposure Signing

Your sensitive data is hashed locally in the browser using SHA-256 — only the 64-character hex digest is sent to the API. FIPSign never sees the original content.

Watch the hash update as you type. The browser computes SHA-256 locally in real time. That hash — not your data — is what travels to POST /sign.
SHA-256 computed locally — this is what travels to the API
Computing...
Signed token (contains hash, not your data)

Mandate — Bounded Authorization

Issue a signed session credential for an agent with explicit scope, budget, and TTL. Walk through the full lifecycle: emit, verify, narrow scope, suspend, and revoke.

1
2
3
4
5
6
7
8
1 Emit · 2 Verify (granted) · 3 Narrow · 4 Verify (denied) · 5 Suspend · 6 Verify (suspended) · 7 Revoke · 8 Verify (revoked)
Mandate issued

Step 2 — Verify an action (expect: granted)

The agent presents its token and requests permission to act.

Verification result

Step 3 — Narrow the scope

Reduce the agent's authorized actions. Scope can only shrink — never expand after issuance. The original scope is preserved in the immutable ML-DSA signature.

Narrow result

Step 4 — Verify removed action (expect: denied)

Try the action that was removed from scope. The same token — but the gate now denies it because scopeCurrent no longer includes it.

Result after narrow

Step 5 — Suspend the mandate

Pause the agent without revoking it. All verify calls will return mandate_suspended until resumed.

Suspend result

Step 6 — Verify while suspended (expect: denied)

The mandate is suspended. Any action is blocked regardless of scope.

Result while suspended

Step 7 — Revoke the mandate

Permanently terminate the mandate. This is irreversible — no further actions are possible on this mandate.

Revocation result

Step 8 — Verify after revocation (expect: denied)

The mandate is permanently revoked. The token is cryptographically valid but the mutable state layer blocks it forever.

Final result

10,000 operations/month — free

No credit card. No sales call. Your own project, your own API key, your own keys.

Create free account →