Bitcoin Universe · Model 20
The digital signature machine
How a signature proves that the owner of a key approved something, without ever revealing the key. Sign, check, then try to cheat.
Demonstration keys only. These keys are generated from public labels, so everyone can compute them. This page never asks for, and never accepts, a real private key or recovery phrase.
A simplified, labelled serialization of a demonstration transaction. Real transaction signatures sign a sighash defined by BIP143 or BIP341. A real transaction has no fee field: the fee is the inputs minus the outputs, and the signature commits to it indirectly through the outputs and the amounts of the inputs it signs (only the signed input's amount under BIP143; all inputs under BIP341).
Proof without revealing the key
A message is not a transaction. Signing a message proves you hold a key. Signing a Bitcoin transaction authorises moving specific coins, because what is signed commits to that transaction's inputs, outputs and amounts.
The values
All keys, hashes and signatures are computed with the project's secp256k1 implementation, tested against official vectors (RFC 6979 ECDSA, BIP340 Schnorr). Generic messages are hashed with SHA-256 in this demo (Bitcoin Core's message signing uses a prefix and double SHA-256); the demonstration transaction is hashed with double SHA-256 of a simplified serialization instead of a real BIP143/BIP341 sighash. Nothing leaves your browser.