Browser 106

max 50MB

Inspector security/pgp-decrypt-file

PGP Decrypt File

Overview

Open a PGP- or GPG-encrypted file with your own private key, entirely on the device — openpgp.js runs in a worker and nothing is uploaded. Drop the .pgp, .gpg or armored .asc file in, unlock your key with its passphrase, and the original comes back with the file name it was encrypted under. The download is offered only once decryption has finished and the integrity check has passed: because that check is a single hash over the whole plaintext, it cannot be confirmed early, so the output is collected and then either handed over or thrown away. A file that was altered or truncated after it was encrypted produces no download at all, rather than a partially written file with a warning next to it. Any signature the file carried is reported alongside it — whose key made it, whether it is valid, whether that key is expired or revoked — and when decryption fails, the reason is named rather than reduced to a single error: not addressed to a key you hold, wrong passphrase, and failed integrity check are three different problems.

Opening a document sent to youDecrypt a contract, report or dataset that a colleague or client encrypted to your public key, and see whether they signed it as well.
Restoring from an encrypted backupRecover a document or archive out of PGP-encrypted backup storage without installing desktop GnuPG to do it.
Confirming nothing leaves the machineOpen the network tab and decrypt: there are no requests to inspect, which is the kind of claim you can check for yourself rather than take on faith.
One-off decryption on a locked-down machineOpen a single .gpg file where installing GnuPG or GPG Suite is not permitted, using a key pasted in and nothing kept afterwards.
Reading team secrets during local developmentDecrypt an encrypted .env or config file shared with the team's PGP keys, without setting up a full local keyring first.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_decrypt_file
Set: Security
Input: text
Output: *
Max file: 50MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop the encrypted file in

A .pgp, .gpg or armored .asc file, whatever produced it. If the ciphertext arrived as pasted text instead, the box below the drop zone takes that.

Unlock your key

Pick your private key from this browser's keyring or paste it in, and enter its passphrase. The passphrase is used for this operation and never stored; the worker holding the unlocked key is destroyed when the operation ends.

Download only if it checks out

Decryption runs to the end and the integrity check is verified before anything is offered. If the check passes you get the original file back, with the name it was encrypted under. If it fails you get nothing — no partial file, no download.

Frequently asked

Why won't this file decrypt?

Three causes, and they are reported separately because they mean different things: the file is not addressed to any key you hold, the passphrase is wrong, or it decrypted but failed its integrity check, meaning it was altered or truncated after encryption. Only the last of those points at the file rather than at your key.

Will I get back exactly the original file?

Yes. The bytes come back identical to what was encrypted, and the file name recorded inside the message is shown so you know what it was called. Nothing is re-encoded on the way through.

What happens if the file has been tampered with?

You get nothing at all. The integrity check covers the whole plaintext, so it cannot be confirmed until the last byte has been decrypted — which means the output is collected first and offered only once the check passes. A file that fails is discarded and no download appears.

How large a file can I decrypt?

The plaintext is held in memory until the integrity check passes, so the ceiling is what your device can hold rather than a server quota. Tens of megabytes is comfortable on a desktop and a phone will give up sooner. For very large archives, desktop GnuPG is the better tool.

Can I decrypt a file that was encrypted for someone else?

No. A file is decryptable only by a key it was addressed to. If the sender encrypted it to several recipients, any one of them can open it with their own private key — but a key that was not among them cannot, and the tool will tell you the file is not addressed to anything you hold.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools