
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
js-sol-sign
Advanced tools
A production-grade CLI tool for signing messages with Solana keypairs. Simple, secure, and easy to use.
npm install -g js-sol-sign
npm install js-sol-sign
js-sol-sign sign -m 'Hello, Solana!' -k ./my-keypair.json
js-sol-sign sign -m 'Hello, Solana!' -p "your-private-key-here"
js-sol-sign verify -m 'Hello, Solana!' -s "signature-here" -p "public-key-here"
js-sol-sign keypair
js-sol-sign keypair -o ./new-keypair.json
When your message contains special characters like !, $, or quotes, use proper escaping:
# Use single quotes for messages with exclamation marks
js-sol-sign sign -m 'Hello World!' -k ./keypair.json
# Use double quotes and escape for single quotes
js-sol-sign sign -m "Don\'t forget this" -k ./keypair.json
# For complex messages, you can use a file
echo "Complex message: !@#$%^&*()" > message.txt
js-sol-sign sign -m "$(cat message.txt)" -k ./keypair.json
# Basic signing
sol-sign sign --message "Your message" --keypair ./keypair.json
# With different output formats
sol-sign sign -m "Your message" -k ./keypair.json -o hex
sol-sign sign -m "Your message" -k ./keypair.json -o base64
# With signature verification
sol-sign sign -m "Your message" -k ./keypair.json --verify
# With base58 private key
sol-sign sign -m "Your message" -p "5Kd3NBUAdUnhyzenEwVLy9pBKxSwXvE9FMPyR4UKZvpe6E6VTjLjyBXhF"
# With JSON array private key
sol-sign sign -m "Your message" -p '[1,2,3,...,64]'
# Basic verification
sol-sign verify --message "Your message" --signature "signature-here" --public-key "public-key-here"
# With different signature formats
sol-sign verify -m "Your message" -s "hex-signature" -p "public-key" -f hex
sol-sign verify -m "Your message" -s "base64-signature" -p "public-key" -f base64
# Generate and display keypair
sol-sign keypair
# Save keypair to file
sol-sign keypair --output ./my-new-keypair.json
# Only show public key
sol-sign keypair --public-key-only
js-sol-sign signSign a message with a Solana keypair.
Options:
-m, --message <message> - Message to sign (required)-k, --keypair <path> - Path to Solana keypair JSON file-p, --private-key <key> - Private key as base58 string or array of bytes-o, --output <format> - Output format: hex, base58, base64 (default: base58)--verify - Verify the signature after signingExamples:
js-sol-sign sign -m 'Hello World' -k ./keypair.json
js-sol-sign sign -m 'Hello World' -p "your-private-key" -o hex --verify
js-sol-sign verifyVerify a signature for a message.
Options:
-m, --message <message> - Original message (required)-s, --signature <signature> - Signature to verify (required)-p, --public-key <key> - Public key to verify against (required)-f, --format <format> - Signature format: hex, base58, base64 (default: base58)Examples:
js-sol-sign verify -m 'Hello World' -s "signature-here" -p "public-key-here"
js-sol-sign verify -m 'Hello World' -s "hex-signature" -p "public-key" -f hex
js-sol-sign keypairGenerate a new Solana keypair.
Options:
-o, --output <path> - Output file path for the keypair--public-key-only - Only display the public keyExamples:
js-sol-sign keypair
js-sol-sign keypair -o ./new-keypair.json
js-sol-sign keypair --public-key-only
JS-Sol-Sign supports three output formats for signatures:
sol-sign keypairJS-Sol-Sign expects Solana keypair files in the standard JSON array format:
[1, 2, 3, ..., 64]
This is a 64-byte array where the first 32 bytes are the private key and the last 32 bytes are the public key.
JS-Sol-Sign provides clear error messages for common issues:
# Clone the repository
git clone https://github.com/Aryamanraj/js-sol-sign.git
cd js-sol-sign
# Install dependencies
npm install
# Build the project
npm run build
# Run tests
npm test
# Run in development mode
npm run dev sign -m "test message" -k ./test-keypair.json
# Run all tests
npm test
# Run tests in watch mode
npm run test:watch
# Run with coverage
npm test -- --coverage
# Lint code
npm run lint
# Fix linting issues
npm run lint:fix
# Format code
npm run format
JS-Sol-Sign can also be used as a library in your Node.js projects:
import { SolanaMessageSigner } from 'js-sol-sign';
const signer = new SolanaMessageSigner();
// Sign with keypair file
const result = await signer.signWithKeypairFile('message', './keypair.json');
// Sign with private key
const result2 = await signer.signWithPrivateKey('message', 'private-key');
// Verify signature
const isValid = await signer.verifySignature('message', 'signature', 'public-key');
// Generate keypair
const keypair = signer.generateKeypair();
Contributions are welcome! Please read our Contributing Guide for details on our code of conduct and the process for submitting pull requests.
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)This project is licensed under the MIT License - see the LICENSE file for details.
See CHANGELOG.md for a detailed history of changes.
Made with ❤️ for the Solana community
FAQs
A CLI tool for signing messages with Solana keypairs
We found that js-sol-sign demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.