PGP · Encrypt, Decrypt, Sign & Verify
A complete OpenPGP toolkit in your browser: encrypt messages and files to someone's public key or a password, decrypt with your private key, sign and verify, and create or inspect PGP keys. Works with GnuPG, Kleopatra, Thunderbird and Proton Mail. Nothing is uploaded.
Create a key pair
Inspect a key
How PGP encryption works
Everyone has a key pair. The public key is shared: anyone can use it to encrypt a message that only you can read, and to check your signatures. The private key stays with you: it decrypts what was sent to you and signs what you send. A message can also be locked with a password instead of a key, which is handy when the other person has no PGP key.
- To send a secret message: paste the recipient's public key in encrypt, type the message, and send them the encrypted text.
- To read one: paste it in decrypt with your private key and passphrase.
- To prove a message or file came from you: sign it with your private key; others verify it with your public key.
Compatible with GnuPG and other OpenPGP apps
The page uses OpenPGP.js, the library behind Proton Mail and many other apps, and follows the OpenPGP standard (RFC 9580 and RFC 4880). Messages, signatures and keys work with GnuPG (gpg), Kleopatra, GPG Suite, Thunderbird, Proton Mail and Mailvelope. New keys use Curve25519 in the widely supported version 4 key format.
Frequently asked questions
Is it safe to paste my private key here?
The page runs entirely in your browser: keys, passphrases and messages are never sent anywhere or saved, and are gone when you close the tab. As with any tool, only paste a private key on a device you trust, and keep it protected with a passphrase.
Which key should I create, Curve25519 or RSA?
Curve25519 keys are small, fast and supported by every current OpenPGP app, so they are the right choice for almost everyone. Choose RSA 4096 only if you need to work with very old software.
What is the revocation certificate for?
If your private key is ever lost or stolen, publishing the revocation certificate tells everyone to stop using your public key. Save it somewhere safe, separate from the key.
Can I verify a software download's PGP signature?
Yes. In verify, choose the downloaded file and its .sig or .asc signature, and paste the publisher's public key. The page shows whether the signature is valid and which key made it; compare that fingerprint with the one the publisher lists.