Browser 106

max 10MB

Inspector security/pgp-import-keys

PGP Import Keys

Overview

Read an OpenPGP key into the browser by pasting the armored block or dropping the file, and see what is actually in it: the full fingerprint, every user ID, the expiry date, whether the key has been revoked, and what it can be used for — encrypting, signing, or both — derived from its subkeys. A block that contains several keys is parsed in full rather than reduced to its first key, which is a common and quiet source of confusion in other tools. Parsing runs on openpgp.js in your own browser and nothing is uploaded. The imported key is usable immediately, on this page and on the encrypt, decrypt, sign and verify routes, without anything being written to the device; keeping it in this browser's keyring is a separate, deliberate step, and a private key is stored only in the passphrase-protected form it arrived in.

Reading a contact's public keyPaste the key someone emailed you and check the fingerprint against what they told you elsewhere, before you encrypt anything to it.
Using your private key onceImport your own key on a machine that has no GnuPG installed, decrypt or sign the one thing you came for, and leave nothing behind on the device.
Unpacking a keyring exportDrop in a file exported from GnuPG that holds several keys and see each one listed on its own, rather than having the block silently reduced to whichever key happened to be first.
Checking a key before you trust itLook at the expiry, the revocation status and the usage flags of a key you have been sent, so you find out here that it expired last year rather than after your message goes unanswered.
Building up a working keyringImport the handful of public keys you actually correspond with and keep them, so the recipient picker on the encrypt routes has them ready next time.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pgp_import_keys
Set: Security
Input: text
Output: —
Max file: 10MB
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the block or drop the file

Anything that begins with a PGP key header is accepted, whether you paste it out of an email or drag the .asc file in. The tool works out for itself whether it is looking at a public key or a private one.

Read what is actually in it

Every key in the block is parsed — not just the first — and each one is shown with its full fingerprint, its user IDs, its expiry, whether it has been revoked, and whether it can encrypt, sign, or both, derived from the subkeys rather than guessed from the key type.

Keep it, or do not

The key is usable immediately, on this page and the others, without being stored. Keeping it in this browser's keyring is a separate click. A private key is only ever stored in its passphrase-protected form.

Frequently asked

What can I paste in?

Standard OpenPGP key blocks — the text starting with -----BEGIN PGP PUBLIC KEY BLOCK----- or -----BEGIN PGP PRIVATE KEY BLOCK-----, as pasted text or as a dropped file. Exports from GnuPG, Thunderbird and Kleopatra all read normally.

Does a block with several keys import all of them?

Yes, and this is worth stating because it is a common failure mode elsewhere: some implementations quietly take the first key in a block and drop the rest. Every key found is parsed and listed separately here.

Are imported keys kept?

Only if you say so. An imported key is usable straight away with nothing written to the device. If you choose to keep it, it goes into this browser's IndexedDB storage on this device alone, and a private key is stored only in its passphrase-protected form — the passphrase itself is never stored. Any key can be removed again, or the whole keyring cleared.

Is it safe to import a private key here?

The key is parsed in your browser and is not sent anywhere; the tool makes no network requests. A private key with no passphrase protecting it is refused rather than stored, because anything that can run script in this origin could read it back out of the browser's storage. Use it for the operation at hand and store nothing, or set a passphrase on it first.

How do I know the key is really theirs?

Compare the full fingerprint shown here against the one the key's owner gives you over a channel you already trust — in person, over the phone, from their website. Nothing about a key block proves who wrote it, and a name and email inside a user ID are just text the key's creator typed.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools