# SLH-DSA (FIPS 205)

> Hash-based signatures (formerly SPHINCS+). Larger signatures, slower signing.

- Source: https://stevenfoerster.com/lab/pqc/slh-dsa/

Lab

Hash-based signatures (formerly SPHINCS+). Larger signatures, slower signing.

Educational demo - don't copy/paste into production

All cryptography runs locally in your browser. Keys and plaintext never leave your device, but this is still a simplified demo.

- [Lattices](https://stevenfoerster.com/lab/pqc/lattices/)
- [LWE](https://stevenfoerster.com/lab/pqc/lwe/)
- [ML-KEM](https://stevenfoerster.com/lab/pqc/ml-kem/)
- [ML-DSA](https://stevenfoerster.com/lab/pqc/ml-dsa/)
- [SLH-DSA](https://stevenfoerster.com/lab/pqc/slh-dsa/)
- [Learn](https://stevenfoerster.com/lab/pqc/learn/)
- [Migration](https://stevenfoerster.com/lab/pqc/migration/)

What this is

A post-quantum cryptography (PQC) signature demo using SLH-DSA (formerly SPHINCS+). It highlights the tradeoffs of hash-based signatures: larger sizes and slower signing for conservative security.

Who it's for

-   Security teams comparing PQC signature options.
-   Engineers planning key management changes.
-   Builders learning hash-based cryptography.

## Signing keypair

Legacy name: SPHINCS+

SLH-DSA trades speed and signature size for conservative hash-based security. Expect large signatures and slower signing.

Parameter set

Generate keypair

Larger parameter sets increase signature size and signing time.

Public key

Copy Export

Size: \-

Secret key

Reveal secret key Copy

Size: \-

Export all (unsafe)

## Sign + verify

Message

Size:

Sign message Verify signature Tamper with message Reset

Signature

Copy

Size: \-

No signature yet.

## Sizes & timings

Sizes

-   Public key: \-
-   Secret key: \-
-   Signature: \-

Timings

-   Key generation: \-
-   Sign: \-
-   Verify: \-

Security model (30 seconds)

SLH-DSA signing happens locally with large hash-based signatures. The browser keeps all keys and messages in-memory, and only the public key is needed for verification. No server-side secrets and no user tracking are used.