rfc4648.js | Pure Javascript implementations of all RFC4648 data

The sign/verify implementation in the Python-code doesn't perform hashing automatically, i.e. the user must explicitly hash the data before signing. During verification, the user must therefore verify the signature against the hash of the data.

The sign/verify implementation in the JavaScript-code performs hashing automatically, i.e. the user must not hash the data before signing. During verification, the user must therefore verify the signature against the data (and not against the hash of the data). The hash algorithm is specified in the key i.e. in generateKey/importKey using {hash: 'hash-algorithm'}.

The error in the posted JavaScript-code is caused by verifying the signature against the hash of the data. This is wrong. The signature must be checked against the data, i.e. in the JavaScript-code the following lines: