PGP Key Generator

Overview

Make an OpenPGP key pair in your browser. openpgp.js does the work in a background worker, so no server sees your key, your passphrase or your name and email. Pick Curve25519 (fast and compact) or RSA 3072/4096 for older software, then set an expiry and a passphrase. You get a public key to share, a protected private key to back up and a revocation certificate to store separately. It's all standard OpenPGP that GnuPG imports.

Encrypted email setupMake your first key pair, share the public half and import the private half into Thunderbird, Kleopatra or gpg, without installing anything first.
Release signing keyMake a dedicated key for signing releases and announcements, with an expiry so an abandoned key doesn't stay trusted forever.
Onboarding a new engineerA new teammate can make a key in a minute and send the public half to whoever runs the vault, with no GnuPG setup needed.
Replacing a key you have lost control ofMake a new pair, publish the old key's revocation certificate and share the new public key. This only works if you kept that certificate.
Learning how key pairs workMake a throwaway pair, encrypt and sign something, and look at the fingerprint and expiry. Nothing is kept unless you ask.

Guides

01 How to generate a PGP key pair

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_generate_keys
Set: Security
Input: text
Output: ASC
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Describe the key

Enter the name and email for the user ID, choose Curve25519 or RSA (3072 or 4096 bits) and set an expiry date. A passphrase is required, because this tool won't hand you an unprotected private key.

Generate it here

openpgp.js makes the key in a background worker in your browser. RSA 4096 can take a while, so you get a timer and a stop button.

Save all three files

Download the public key to share, the private key to back up and the revocation certificate. Keeping the key in this browser's keyring is up to you.

Frequently asked

What is a PGP key pair for?

The public key is the half you share: people use it to encrypt things only you can read and to check your signatures. The private key stays with you and does the decrypting and signing. Neither is ever sent anywhere.

Do I have to set a passphrase?

Yes. It protects the private key file if anyone ever copies it. It's used to lock the key and is never stored, not in the keyring and not anywhere else.

Curve25519 or RSA?

Curve25519, unless you need to work with software that can't read it. It's quick to generate, makes much smaller keys and signatures, and is what modern OpenPGP prefers. RSA 3072 and 4096 are there for older software and take longer to generate.

What is the revocation certificate for?

It tells everyone a key is no longer valid. Publish it and anyone with your public key knows to stop using it. Save it when you make the key and keep it somewhere else, because you can't make one later without the passphrase.

Why does the key need an expiry date?

If you lose the key or the passphrase and can't revoke it, the expiry makes the key stop being used on its own, so it doesn't collect mail you can never read. An expired key still verifies signatures it made while it was valid.

Will these keys work with GPG?

Yes. The output is standard OpenPGP and we've tested it against GnuPG: gpg --import accepts the key, and gpg can then encrypt to it and verify its signatures.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/