minisign
Hacker ApprovedFile signing tool in Privacy & security
Simple, boring tool for signing files, praised as a cleaner alternative to PGP and recommended for signatures. Critics note it lacks trust inheritance and fits poorly with commit signing.
Simple, boring tool for signing files, praised as a cleaner alternative to PGP and recommended for signatures. Critics note it lacks trust inheritance and fits poorly with commit signing.
21 people gave an opinion
- recommend it
- 16
- criticize it
- 5
- approval share
- 76%
Recommended in 5 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 16 people recommend itNeeds 10 or more, met.
- 3.2 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Simpler and more boring than PGP
“much neater stack that does basically everything I would need to use PGP for”
Comment from 3 Jan 2026 in “The PGP Problem (2019)” “Boring, simple, fit-for-purpose.”
Comment from 3 Jan 2026 in “The PGP Problem (2019)” Reliable for everyday signing
“Signal/WhatsApp for messaging, age for file encryption, minisign for signatures, etc.”
Comment from 27 Dec 2025 in “Gpg.fail” “Ssh/age/minisign just work for my use cases.”
Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite” Adopted in professional environments
“more professional environments have integrated age and minisign than have integrated PGP”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “also sequoia, minisign and age”
Comment from 27 Dec 2025 in “Gpg.fail”
What people warn about
Each mark is one comment
Affected by several GnuPG vulnerabilities
“discovered multiple vulnerabilities in cryptographic utilities, namely in GnuPG, Sequoia PGP, age, and minisign”
Comment from 1 Jan 2026 in “A Vulnerability in Libsodium” “minisign was affected by most everything GnuPG was, but had a faster turnaround to patching.”
Comment from 3 Jan 2026 in “The PGP Problem (2019)” “minisign was also vulnerable in the gpg.fail exposures”
Comment from 3 Jan 2026 in “The PGP Problem (2019)” Lacks trust and human-factor solutions
“Minisign and Age entirely dodge the actually hardest problem with humans using cryptography”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “The 4 tools you've listed all lack any notion of trust inheritance”
Comment from 14 Nov 2025 in “GPG and Me (2015)”
What people said
19 of the 25 comments that mention it, newest first. Each links to the original comment.
“But then we cannot sign commits or code reviews with minisign because non standard”
“Minisign is strictly worse in every way.”
“Moving to minisign would be a strict improvement.”
“Ssh/age/minisign just work for my use cases.”
“Boring, simple, fit-for-purpose.”
“much neater stack that does basically everything I would need to use PGP for”
“minisign was also vulnerable in the gpg.fail exposures”
“The overall experience was annoying given that the problems with pgp/gpg are esoteric and abstract”
“minisign was affected by most everything GnuPG was, but had a faster turnaround to patching.”
“swap the signing tool to a better one until everyone can verify the new signatures”
“discovered multiple vulnerabilities in cryptographic utilities, namely in GnuPG, Sequoia PGP, age, and minisign”
“these issues are not a big deal”
“Signal/WhatsApp for messaging, age for file encryption, minisign for signatures, etc.”
“also sequoia, minisign and age”
“The 4 tools you've listed all lack any notion of trust inheritance”
“I know of no solutions even close to this for Minisign or Age keys”
“more professional environments have integrated age and minisign than have integrated PGP”
“Minisign and Age entirely dodge the actually hardest problem with humans using cryptography”
“What I take issue with is people recommending age or minisign or signing with ssh keys”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.