What is the SIG file format?
A .sig file is a detached cryptographic signature produced by OpenPGP-compatible tools such as GnuPG (gpg). Unlike a signature embedded inside a signed document, a detached .sig sits in a separate file alongside the original - for example installer.exe paired with installer.exe.sig. This allows the integrity and authenticity of the original file to be verified without modifying it in any way.
The signature is stored in one of two forms:
- ASCII-armored text - a human-readable block beginning with
-----BEGIN PGP SIGNATURE-----and ending with-----END PGP SIGNATURE-----, suitable for pasting into email or plain text channels. - Binary OpenPGP packet - a compact binary form whose first byte is a signature packet tag (high bit always set; common values are
0x88,0x89, or0xC2).
To verify a .sig file against its companion document, run gpg --verify file.sig file. GnuPG checks the data against the signer's public key and reports whether the signature is valid and which key produced it.
Detached .sig files are widely used when distributing software releases, OS images, and package archives, giving end-users a reliable way to confirm that a download has not been tampered with. The format is governed by the OpenPGP standard, defined in RFC 4880 (2007) and updated by RFC 9580 (2024). Related extensions include .asc (ASCII-armored OpenPGP output), .gpg (binary GnuPG data), and .pgp (PGP-encrypted or signed data).
Security & safety
RISK: LOWA detached PGP .sig is itself harmless - it contains no executable code. The security value runs the other way: a .sig is a tool that PROTECTS you, by letting you confirm a download wasn't tampered with. Two real pitfalls: (1) verification is only as trustworthy as the public key - download the publisher's key from an independent, official channel and confirm its fingerprint, or an attacker who swapped both the file and the key could still show a 'Good signature'; (2) 'Good signature' proves integrity and authorship, not that the software is safe - a malicious publisher can sign malware.
Format details
in a nutshell- Email signature block - Mail clients store the canned text appended to outgoing messages (name, title, contact line) as a plain-text .sig - the classic Unix '.signature'; just text in an editor.
- Broderbund Print Shop document - Legacy Broderbund titles (The Print Shop and relatives) used .sig for sign/banner project files, openable only in the matching Broderbund software.
Programs that open SIG files
Windows1 app
Gpg4win (Kleopatra + GpgEX)
Open-source Install Gpg4win, import the publisher's public key, then right-click the .sig → More GpgEX options → Verify (or run 'gpg --verify file.sig file'). 'Good signature' = the download is authentic. 
macOS2 apps
GnuPG (gpg)
Open-source Install via GPG Suite or Homebrew ('brew install gnupg'), import the public key, then 'gpg --verify file.sig file' in Terminal to verify a download.
GPG Suite
Free Mac GUI for GnuPG (GPG Keychain + Services); import the key and verify the .sig from Finder or Terminal. 
Linux2 apps
GnuPG (gpg)
Open-source Pre-installed on most distributions: import the publisher's key, then 'gpg --verify file.sig file'. Look for 'Good signature' and a matching key fingerprint.
Kleopatra
Open-source GUI key manager (KDE); import keys and verify signatures without the command line. Technical details
deep spec| MIME type | application/pgp-signature |
| Storage forms | ASCII-armored text or binary OpenPGP packet |
| ASCII-armored header | -----BEGIN PGP SIGNATURE----- |
| Binary magic bytes | Signature packet tag byte at offset 0 (commonly 0x88, 0x89, or 0xC2; high bit always set) |
| Usage pattern | Detached - the .sig file is stored separately from the file it signs |
| File pairing convention | Companion file shares the same base name (e.g., archive.tar.gz + archive.tar.gz.sig) |
| Verification command | gpg --verify file.sig file |
| Supported hash algorithms | SHA-256, SHA-384, SHA-512, SHA-224; SHA-1 supported for legacy compatibility |
| Supported public-key algorithms | RSA, DSA, ECDSA, EdDSA (Ed25519, Ed448) |
| ASCII-armored encoding | Base64 with 76-character line wrap plus a CRC-24 checksum trailer line |
| Typical file size (ASCII form) | 300-600 bytes for a single-key signature |
| Governs one file only | Each .sig covers exactly one target file; multi-file distribution requires one .sig per file |
| Trust model | Web of Trust (WoT) or OpenPGP CA; validity depends on whether the signer's key is trusted locally |
| Governing standard | OpenPGP - RFC 2440 (1998), RFC 4880 (2007), RFC 9580 (2024) |
| Released | OpenPGP signatures: PGP 1991, standardized as RFC 2440 (1998) / RFC 4880 (2007) / RFC 9580 (2024) |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
SIG conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about SIG files.
