As flygoing stated, you can use the web3.eth.sign
function found here in the wiki.
web3.eth.sign(address, dataToSign, [, callback])
Signs data from a specific account. This account needs to be unlocked.
**Parameters**
String - Address to sign with.
String - Data to sign.
Function - (optional) If you pass a callback the HTTP request is made asynchronous. See this note for details.
**Returns**
String - The signed data.
After the hex prefix, characters correspond to ECDSA values like this:
r = signature[0:64]
s = signature[64:128]
v = signature[128:130]
Note that if you are using ecrecover, v will be either "00" or "01". As a result, in order to use this value, you will have to parse it to an integer and then add 27. This will result in either a 27 or a 28.
**Example**
var result = web3.eth.sign("0x135a7de83802408321b74c322f8558db1679ac20", "0x9dd2c369a187b4e6b9c402f030e50743e619301ea62aa4c0737d4ef7e10a3d49"); // second argument is web3.sha3("xyz")
console.log(result); // "0x30755ed65396facf86c53e6217c52b4daebe72aa4941d89635409de4c9c7f9466d4e
If you give the user you are trying to validate a specific message to sign using this method then as stated This account needs to be unlocked.
You are able to validate the ownership of that address without using gas.