PGP Import Keys

Overview

Paste a PGP key block or drop the file to see what's in it: the full fingerprint, every user ID, the expiry date, whether it's revoked, and whether it can encrypt, sign or both. A block with several keys is read in full. It all runs on openpgp.js in your browser, and nothing is uploaded. To use a key on the encrypt, decrypt, sign and verify pages, keep it in this browser's keyring. That's a separate step, after you've checked the fingerprint.

A contact's public keyPaste the key someone emailed you, check the fingerprint, and keep it. Then you can encrypt to it.
Use your private key on another machineKeep your protected private key here, decrypt or sign, then remove it on PGP Export Keys.
Unpack a keyring exportDrop in a GnuPG export with several keys and see each one listed separately.
Check a key before trusting itSee the expiry, revocation status and usage flags before you rely on a key you were sent.
Build a small keyringKeep the public keys you actually write to, so they're ready in the recipient picker next time.

Guides

01 How to encrypt a file for someone else with PGP 02 How to verify a signed file or software release

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_import_keys
Set: Security
Input: text
Output: —
Max file: 10MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste or drop the key

Paste the block from an email or drag in the .asc file. The tool tells public and private keys apart on its own.

See what's in it

Every key in the block is shown with its fingerprint, user IDs, expiry, revocation status and whether it can encrypt, sign or both.

Keep it or don't

Turn on Keep this key in this browser, check the fingerprint, then press Import this key. A kept key shows up on the encrypt, decrypt, sign and verify pages. A private key is only kept with its passphrase protection.

Frequently asked

What can I paste in?

Standard OpenPGP key blocks, the text that starts with -----BEGIN PGP PUBLIC KEY BLOCK----- or -----BEGIN PGP PRIVATE KEY BLOCK-----. Paste the text or drop the file. Exports from GnuPG, Thunderbird and Kleopatra all work.

Does a block with several keys import all of them?

Yes. Some tools quietly keep the first key and drop the rest. Here every key is read and listed on its own.

Are imported keys kept?

Only if you choose to: turn on Keep this key in this browser and press Import this key. Saved keys go into this browser's IndexedDB storage on this device only. A private key is saved only in its passphrase-protected form, and the passphrase itself is never stored. You can remove any key or clear the whole keyring.

Is it safe to import a private key here?

The key is read in your browser and the tool makes no network requests. A private key without a passphrase is never stored, because any script running on this site could read it back. Set a passphrase on it first, for example with gpg --passwd, then import it again.

How do I know the key is really theirs?

Compare the full fingerprint with the one the owner gives you somewhere you already trust: in person, by phone or on their website. A key block doesn't prove who made it, and the name and email in a user ID are only text.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/