Why?

PGP has a feature that allows you to sign a file with your private key so that anyone with your public key can verify that it's from you. This is great for preventing impersonators, because any file sent by them won't have your signature, making it clear that it wasn't you (this obviously doesn't apply if your private key has been stolen/compromised).

With the exception of text posts/web pages, every email and publicly accesible file uploaded here or anywhere else is signed with my public key (4492D84F3DED72F1A075E4132D1B3BF6A85A6B15). Anything else here without a signature is not from me.

Verifying the files

We'll be using GnuPG for this guide.

If you don't have your own private/public key already, create one!

gpg --full-gen-key

cd into the directory you downloaded my public key and import it so that you have access to it:

gpg --import 720pgp.asc

After that, sign my public key with your private key. This is to confirm that you trust 4492D84F3DED72F1A075E4132D1B3BF6A85A6B15 (my fingerprint) is me:

gpg --sign-key 720p.org@proton.me

Now that everything's ready, time to verify a file!

gpg --verify supertux.jpg.sig supertux.jpg.sig

If the file and the signature match, you should get this:

gpg: Signature made jue 09 oct 2025 02:25:05 AST
gpg:                using EDDSA key 4492D84F3DED72F1A075E4132D1B3BF6A85A6B15
gpg: Good signature from "720p.org@proton.me <720p.org@proton.me>" [full]

If they do not match and/or the fingerprint is different from mine, then it is not me.

Where to get my signatures

When it comes to images, you should be able to click on them for a direct download of their signature.

Not every file is like this, though. In that case, you can manually access it via their URL:

URL to original file:

https://720p.org/subdirectory-to-file/file.ext

URL to its signature:

https://720p.org/subdirectory-to-file/signatures/file.ext.sig

Real world example:

https://720p.org/images/button.gif
https://720p.org/images/signatures/button.gif.sig

And that's how you know it's me!