PGP Encryption & Digital Signatures

Overview

OpenPGP in your browser, built on openpgp.js. Generate a Curve25519 or RSA key pair, or import keys you already have. Encrypt to one or more people, decrypt, sign and verify, with each signature fact on its own line. Keys and messages work with GnuPG in both directions, and nothing leaves your computer.

Send a private messageEncrypt a message or file to one or more people's public keys, and sign it so they know it came from you.
Read encrypted mailPaste the PGP block or drop the file, unlock your key, and read it along with any signature it carried.
Check a release signatureVerify a .asc or .sig against the file and the publisher's key, and see validity, signer and key status as separate facts.
Create a PGP identityGenerate a key pair, save its revocation certificate, and export the public and private keys as two separate files.
Use a borrowed computerImport your key, use it, then remove it from this browser before you leave.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp
Set: Security
Input: MIXED
Output: MIXED
Max file: 50MB
Batch: single file

PLAIN OCTET-STREAM PGP-KEYS PGP-SIGNATURE PGP-ENCRYPTED

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Bring a key

Generate a key pair, or paste or drop an existing key (a block with several keys imports all of them).

Pick the operation

Encrypt, decrypt, sign or verify, with typed text or a dropped file.

Take the result

Copy or download the output; public and private keys always export as separate files.

Frequently asked

Will GnuPG read what this tool produces?

Yes. The output is standard OpenPGP, tested both ways: keys made here import into gpg, gpg accepts signatures made here, and messages gpg encrypts to you open here.

Where do my keys go?

Nowhere, unless you choose to keep one. Kept keys go into this browser's IndexedDB on this device, private keys only in passphrase-protected form, and the passphrase itself is never stored. You can forget one key or all of them.

Which key types can I generate?

Curve25519, or RSA at 3072 or 4096 bits, with an expiry date and a required passphrase. You also get a revocation certificate to download. Keep it safe: it lets you retire the key if you lose the passphrase.

What does a valid signature actually prove?

That the data hasn't changed since it was signed, and that the private key matching the public key you checked against made the signature. It doesn't prove who owns the key, and the signing time is only the signer's claim. That's why each fact gets its own line.

What happens if decryption fails its integrity check?

You get nothing. Output is released only after the integrity check passes, so a tampered or truncated message never lands on your disk half-written.

Can I export a public and a private key in one file?

No, on purpose. Export gives you two buttons and two files, with the word private in one filename. A single file with both is how private keys get published by accident.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/