Browser 106

no file limit

Inspector security/pgp-decrypt-message

PGP Decrypt Message

Overview

Paste an OpenPGP message block, unlock your private key with its passphrase, and read the plaintext — all on the device, with openpgp.js doing the work in a worker and nothing uploaded anywhere. Two things set this apart from a plain decrypt box. First, the output is released only once the message has fully decrypted and its integrity check has passed: a message that was altered or truncated after it was encrypted produces no text at all rather than plaintext with a warning attached. Second, whatever signature the message carried is reported alongside it — whose key made it, whether that signature is valid, and whether the key is expired or revoked — and if it carried none you are told that too, because an encrypted message with no signature says nothing about who wrote it. When decryption does fail, the reason is named: not addressed to a key you hold, wrong passphrase, or failed integrity check are three different problems with three different answers.

Reading encrypted mailOpen a message a colleague or contact encrypted to your public key, without configuring an email client's PGP support first.
Picking up a shared credentialDecrypt the secret a teammate sent you over PGP, and see at the same time whether they signed it — which is what tells you the credential came from them and not from someone impersonating them.
Receiving a confidential tipJournalists and their sources exchange encrypted messages; decrypting on the device means the plaintext never exists anywhere but in front of you.
Opening an encrypted backup blobRecover a PGP-encrypted export from a password manager or a vault without handing the ciphertext to a third-party service to open.
Decrypting on a locked-down machineRead one encrypted message on a machine where installing GnuPG is not an option, using a key pasted in and nothing kept on the device.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_decrypt_message
Set: Security
Input: text
Output: TXT
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the message

Everything from -----BEGIN PGP MESSAGE----- to the end of the block. You can drop the file instead if it arrived as an attachment; the page accepts either.

Unlock your key

Pick your private key from this browser's keyring or paste it in, and enter its passphrase. The passphrase is held in one place for the length of the operation and is never stored — not in the keyring, not anywhere.

Read the plaintext and the facts around it

The message is released only once it has decrypted and its integrity check has passed. If it carried a signature you are told whose key made it and whether that signature is valid; if it carried none, you are told that too, because an encrypted message with no signature proves nothing about who wrote it.

Frequently asked

Why won't this message decrypt?

There are three different reasons and the tool distinguishes them rather than reporting one failure. Either the message is not addressed to any key you hold, or the passphrase is wrong, or the message decrypted but failed its integrity check — meaning it was altered or truncated after it was encrypted. Each says something different about what to do next.

What happens on a failed integrity check?

You get nothing. Output is released only after the whole message has decrypted and the check has passed, so a tampered message never appears on screen and never reaches your disk as a half-written file. Most desktop tools will hand you the plaintext with a warning; this one does not.

Does decrypting tell me who sent the message?

Only if the sender signed it, and the tool says which. Encryption on its own proves nothing about authorship, because anyone holding your public key can encrypt to you. If there is a signature, you are shown whose key made it and whether that key is expired or revoked.

What if I have forgotten the passphrase?

The message cannot be decrypted. There is no recovery, no reset and no back door — that is what the passphrase is for. If you kept the revocation certificate that came with the key, publish it so people stop encrypting to a key you can no longer read, and generate a new pair.

Is it safe to paste my private key here?

The key and the passphrase stay on the device; the tool makes no network requests. Everything touching your unlocked key runs in a worker that is destroyed after any operation that involved a passphrase. Nothing is stored unless you explicitly choose to keep the key, and even then only in its passphrase-protected form.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools