Browser 106

no file limit

Inspector security/pgp-generate-keys

PGP Key Generator

Overview

Generate an OpenPGP key pair inside your browser, with openpgp.js doing the work in a background worker — no server sees your key, your passphrase or the name and email that go into the user ID. Choose Curve25519, which is fast and compact, or RSA at 3072 or 4096 bits for software that cannot read anything else; set an expiry date; and pick a passphrase, which is required rather than optional, because this tool will not hand you an unprotected private key. What you get back is three things: the public key to give out, the passphrase-protected private key to back up, and a revocation certificate to store separately in case you ever lose the passphrase. All of it is standard OpenPGP output, checked against GnuPG in both directions, so gpg --import accepts it and everything built on it works from the command line afterwards.

Encrypted email setupGenerate a first key pair, hand the public half to the people who will write to you, and import the private half into Thunderbird, Kleopatra or gpg — without installing anything to make the key in the first place.
Release signing keyMaintainers create a dedicated key for signing tarballs and announcements, with an expiry date so an abandoned key does not stay trusted forever, and publish the fingerprint alongside it.
Onboarding a new engineerSomeone joining a team that shares secrets over PGP can generate a key in a minute and send the public half to whoever holds the vault, with no local GnuPG setup as a prerequisite.
Replacing a key you have lost control ofGenerate a fresh pair, publish the old key's revocation certificate, and hand out the new public key — the sequence you cannot do without having kept the revocation certificate in the first place.
Learning how key pairs workGenerate a throwaway pair, encrypt something to it, sign something with it, then look at the fingerprint and the expiry — all of it discardable, since nothing is kept unless you ask for it to be.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_generate_keys
Set: Security
Input: text
Output: ASC
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Describe the key

Enter the name and email that go into the user ID, choose Curve25519 or RSA at 3072 or 4096 bits, and set an expiry date. A passphrase is required, not optional — an unprotected private key is not something this tool will hand you.

Generate it here

The key is generated by openpgp.js inside a worker in your own browser. RSA at 4096 bits can take a while and shows an elapsed counter with a stop button, since nothing has been written yet and the only thing a stop discards is a key nobody has seen.

Take all three artefacts

Download the public key to hand out, the private key to back up, and the revocation certificate that is produced alongside them. Keeping the key in this browser's keyring is a separate step you choose, not something that happens automatically.

Frequently asked

What is a PGP key pair for?

The public key is the half you give away: anyone can use it to encrypt something only you can read, or to check a signature you made. The private key is the half you keep, and it is what decrypts and signs. This tool generates both at once and never sends either anywhere.

Do I have to set a passphrase?

Yes. The passphrase is what protects the private key file if it is ever copied, and it is the only thing standing between the file and whoever holds it. It is used to lock the key and is never stored — not in the keyring, not anywhere.

Curve25519 or RSA?

Curve25519 unless something you have to interoperate with cannot read it. It generates in a moment, produces much smaller keys and signatures, and is what modern OpenPGP implementations prefer. RSA 3072 and 4096 are offered for older software; both take noticeably longer to generate.

What is the revocation certificate for?

It is how you tell the world a key is dead. Publish it and anyone holding your public key learns to stop encrypting to it. Download it when the key is generated and store it apart from the key, because you cannot make one later without the passphrase.

Why does the key need an expiry date?

An expiry is a dead man's switch: if you lose the key or the passphrase and cannot revoke it, the key stops being used on its own instead of collecting encrypted mail you can never read. An expired key still verifies signatures it made while it was valid.

Will these keys work with GPG?

Yes. The output is standard OpenPGP, and the round trip has been checked against GnuPG: a key generated here imports with gpg --import, and gpg then encrypts to it and verifies signatures made with it.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools