Browser 106

max 50MB

Inspector security/pgp

PGP Encryption & Digital Signatures

Overview

An OpenPGP toolkit that runs in your browser on openpgp.js, the reference JavaScript implementation. Generate a Curve25519 or RSA 3072/4096 key pair with an expiry date and a required passphrase, or import an existing key by pasting an armored block or dropping a file — including a block that holds several keys at once. Encrypt to one or more recipients and sign at the same time if you want to; decrypt, and see which signature the message carried, if any; sign as cleartext, inline, or as a detached signature; and verify one, with each fact on its own line instead of folded into a single green tick. Keys you choose to keep are written to this browser's IndexedDB storage on this device only, private keys never in anything but their passphrase-protected form, and the keyring can be cleared one key at a time or all at once. Output has been checked against GnuPG in both directions, so a key generated here imports on the command line and a message GnuPG encrypts to you opens here.

Send something only one person can readEncrypt a message or a file to a colleague's public key, optionally signing it at the same time so they can tell it came from you. Add several recipients and the session key is wrapped for each of them, so any one can open it with their own private key.
Open encrypted mail without a desktop clientPaste a PGP message block or drop the file, unlock your private key with its passphrase, and read it. Any signature the message carried is reported alongside the plaintext rather than left unmentioned.
Check a release signatureVerify a detached .asc or .sig against the file it covers and the publisher's public key. You are told whether the signature is cryptographically valid, whose key made it, and whether that key is expired or revoked — as separate facts, not one verdict.
Set up a PGP identity from scratchGenerate a key pair with a passphrase and an expiry, download the revocation certificate that comes with it, then export the public key to hand out and the private key to back up — always as two separate files.
Work on a machine you do not ownEvery operation works with a key pasted in and nothing written to the device. Keeping a key in the keyring is a separate, deliberate step, so on a borrowed machine you can simply not take it.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp
Set: Security
Input: MIXED
Output: MIXED
Max file: 50MB
Batch: single file

PLAIN OCTET-STREAM PGP-KEYS PGP-SIGNATURE PGP-ENCRYPTED

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Bring a key

Generate a Curve25519 or RSA pair with a passphrase and an expiry, or import one by pasting an armored block or dropping a file. A block containing several keys imports all of them rather than the first. Keeping any of them in the keyring is a separate step you have to take.

Pick the operation

Encrypt to one or more recipients, decrypt with your own key, sign as cleartext, inline or detached, or verify a signature. Every route accepts typed text or a dropped file, so the same page handles a pasted message block and a 40 MB archive.

Take the result

Copy the armored output, or download it. Keys are exported as two separate artefacts — the public key to share, the private key to back up — and a generated key's revocation certificate is offered as its own download.

Frequently asked

Will GnuPG read what this tool produces?

Yes. It runs on openpgp.js and emits standard OpenPGP output, and the round trip has been checked in both directions: a key generated here imports into gpg, gpg reports a good signature on a signature made here, and a message gpg encrypts to your key decrypts here.

Where do my keys go?

Nowhere, unless you ask. Every operation works with a key pasted in and nothing stored. If you choose to keep a key, it is written to this browser's IndexedDB storage, on this device only — a private key is stored solely in its passphrase-protected form, and the passphrase itself is never stored. You can clear a single key or the whole keyring.

Which key types can I generate?

Curve25519 or RSA at 3072 or 4096 bits, with an expiry date and a passphrase, which is required rather than optional. A revocation certificate is produced alongside the key and offered as a download — keep it somewhere safe, because it is what lets you retire the key if you ever lose the passphrase.

What does a valid signature actually prove?

That the bytes have not changed since they were signed, and that the signature was made with the private key matching the public key you checked it against. It does not prove the key belongs to the person named on it, and the signing time is stated by the signer rather than proved. Those facts are reported on separate lines for exactly that reason.

What happens if decryption fails its integrity check?

You get nothing. Output is released only once the message has decrypted and its integrity check has passed; a message that fails produces no file and no text, so a tampered or truncated message never reaches your disk half-written.

Can I export a public and a private key in one file?

No, and that is deliberate. Export gives you two buttons and two files, with the word private in one of the filenames. A single file holding both is how private key material gets published by accident.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools