🔐 PGP Key Generator

🛡️ Privacy notice

Your passphrase and private key are generated and held entirely in this browser tab. Nothing is uploaded. Save the private key and passphrase somewhere secure before closing the page — there is no recovery.

🧾 User ID

Combined as Name (Comment) <email> per RFC 4880 §5.11.

🔑 Passphrase

If set, encrypts the private key with S2K (RFC 4880 §3.7). Without a passphrase the private key block is plaintext — fine for ephemeral test keys, dangerous for anything else.

🧮 Algorithm

Curve25519 is the fastest (sub-second) and the modern default in RFC 9580. RSA 4096 may take 10–30 s in the browser.

⏳ Expiry

Stored in the self-signature as Key Expiration Time (RFC 4880 §5.2.3.6). Email keys typically use 2 years; CI keys use shorter windows.

⚙️ Generate

{{ progressMessage }}

The first click fetches OpenPGP.js (~700 KB) from cdn.jsdelivr.net with SRI verification. Subsequent generations reuse the loaded library.

🔎 Fingerprint

{{ fingerprintDisplay }}
Key ID (long, 64-bit): {{ keyId }}

Always verify the full fingerprint over a side channel — key IDs alone are unsafe.

📤 Public key

🔒 Private key

Save this and your passphrase. Loss is unrecoverable.

📜 Revocation certificate

Store this separately from the private key. Publish only if the key is compromised — once revoked, the key cannot be un-revoked.

⚠️

ℹ️ About PGP Key Generator

What this tool does

Generates an OpenPGP key pair — public key, private key, revocation certificate, fingerprint, and key ID — entirely in your browser. The output is ASCII-armored (base64 wrapped in -----BEGIN PGP …----- markers) and ready to drop into GnuPG, GPG Suite, OpenKeychain, Thunderbird, Proton Mail, or any RFC 4880-compliant client.

Your passphrase, primes, scalars, and private key material are generated by the browser's crypto.getRandomValues CSPRNG and never cross the network. Read the dependency notice below before generating sensitive keys.

⚠️ External dependency — read this first

OpenPGP key generation is genuinely complex (RSA prime generation, ECC scalar selection, packet framing, self-signature binding, S2K-encrypted private key serialization). Implementing it from scratch would be reckless. This tool therefore uses OpenPGP.js, the reference JavaScript implementation maintained by the Proton Mail team.

Unlike every other tool on this site, OpenPGP.js is not bundled into the page. The library is ~700KB minified and would inflate every other tool's bundle if it were a top-level dependency. Instead, when you click Generate, the page fetches the library on demand from cdn.jsdelivr.net with the URL pinned to an exact version ([email protected]/dist/openpgp.min.js), crossorigin="anonymous" and referrerpolicy="no-referrer". The page is also wired for optional Subresource Integrity (SRI) verification: when the SHA-384 hash is provided in the source the browser will refuse to execute the script if the file at the CDN no longer matches.

If you are generating a long-lived high-value key (e.g. a release signing key, a corporate identity key), use gpg --full-generate-key on a trusted offline machine instead. This page is convenient for testing, ephemeral keys, email keys, and learning the format — not for keys that need to outlive the next ten years on an air-gapped device.

The OpenPGP packet format (RFC 4880)

An OpenPGP key block is a stream of packets: a primary key packet, one or more user ID packets, self-signature packets binding each user ID to the primary key, optional subkey packets with their own binding signatures, and (for transferable secret keys) the same shape with private key material instead of public. Each packet has a header byte, length encoding, and a body whose shape depends on the packet tag.

ASCII-armored output adds a base64 wrapper, a CRC-24 checksum, and the -----BEGIN PGP …----- / -----END PGP …----- markers so the key block can survive plain-text email and clipboard round-trips without corruption.

Algorithm strength ratings (mandatory disclosure)

  • RSA 2048 — Secure today. Strength rating: Medium. Recommended usage: Modern applications. NIST SP 800-57 considers RSA 2048 acceptable through approximately 2030. Generation is fast (under a second in the browser). Fine for email or short-lived signing keys.
  • RSA 3072 — Secure. Strength rating: Strong. Recommended usage: Modern applications. NIST equivalent of 128-bit symmetric strength. Slower to generate (several seconds in the browser). Good default for new email keys.
  • RSA 4096 — Secure (overkill for most users). Strength rating: Overkill. Recommended usage: Long-lived high-value keys. Generation can take 10–30 seconds depending on hardware. Roughly 256-bit symmetric equivalent. Slower at every signature/encryption operation but future-proofed against incremental advances in classical factoring.
  • Curve25519 (Ed25519 signing + X25519 encryption) — Secure and modern. Strength rating: Strong. Recommended usage: Modern applications, preferred. Defined for OpenPGP in RFC 9580 (libgcrypt-compatible since 2.1.x). ~128-bit symmetric equivalent, ~100x faster to generate and sign than RSA 4096, tiny key material (32-byte secret), modern side-channel-resistant design. Not yet universally supported by old GnuPG versions (need 2.1+); recipients on Windows GnuPG 1.x or legacy Symantec/PGP Corp builds cannot consume it.
  • NIST P-256 / P-384 / P-521 (ECDSA + ECDH) — Secure. Strength rating: Strong (P-256 ≈ RSA 3072, P-384 ≈ RSA 7680, P-521 ≈ RSA 15360). Recommended usage: Environments mandating NIST-approved curves (US Federal, some financial). The NIST curves are cryptographically sound but their parameter generation has been the subject of public concern (RFC 7748 §1) — Curve25519 avoids that question by deriving its parameters from a fixed seed. Some older OpenPGP implementations do not implement ECDH over the NIST curves.
  • DSA / ElGamal (not offered by this tool) — Deprecated. 1024-bit DSA is no longer safe. If you need 2048-bit DSA for legacy interop, use GnuPG directly.
  • RSA 1024 (not offered by this tool) — Broken in practice. NIST deprecated <2048 in 2014; academic distributed factoring has reached 829 bits (RSA-250, 2020). Never use.

Practical use cases

  • Email encryption / signing with Thunderbird + Enigmail successor (built-in OpenPGP since Thunderbird 78), Proton Mail, or Mailvelope.
  • Signing Git commits and tags — set user.signingkey to the key ID and enable commit.gpgSign. GitHub shows a green "Verified" badge once the public key is uploaded to your account.
  • Signing software releases (RPM, deb, source tarballs). Distribute the public key fingerprint over a separate channel so users can validate downloads.
  • Encrypting backups with gpg --encrypt --recipient file.tar.gz.
  • Testing PGP workflows in CI / staging — generate a throwaway key, sign or encrypt a payload, verify, throw it away.

What the output looks like

For each generation the tool emits five artifacts:

  • Public key block — share this with correspondents. Safe to upload to a keyserver (keys.openpgp.org, keys.mailvelope.com).
  • Private key block — keep this secret. If you set a passphrase, the private key is S2K-encrypted in place (RFC 4880 §3.7) so the block can sit on disk without the passphrase being recoverable.
  • Revocation certificate — a pre-signed revocation packet you can publish later if the private key is lost or compromised. Generate this now, store it separately from the private key, and publish it the moment you suspect compromise.
  • Fingerprint — 40 hex characters in groups of four. The fingerprint is the canonical identifier for the key — show it over a side channel (in person, on a business card, in a signed message from a previously-trusted key).
  • Key ID — last 16 hex characters of the fingerprint. Used as shorthand but should never be relied on for trust (32-bit key IDs collide; even 64-bit key IDs have public collisions). Always verify the full fingerprint.

Source references

  • RFC 4880 — OpenPGP Message Format (the original spec, November 2007).
  • RFC 6637 — Elliptic Curve Cryptography (ECC) in OpenPGP (June 2012) — defines the NIST P-256/P-384/P-521 ECDH/ECDSA bindings.
  • RFC 9580 — OpenPGP refresh, the modernised spec with Curve25519, Ed25519, X25519 native packets (July 2024).
  • GnuPG documentation — the canonical command-line implementation.
  • OpenPGP.js — the library this tool loads on demand.

Privacy and threat model

  • The page contains no analytics calls during key generation — the only network request is the one-time CDN fetch of OpenPGP.js, gated behind your explicit click on Generate.
  • Key material is held in JavaScript memory only for the lifetime of the page. There is no persistent storage; closing the tab loses the key unless you copy or download it.
  • The encrypted private key block is safe to store. The raw unencrypted private key (if you generate without a passphrase) is dangerous to leave anywhere — treat it like a root SSH key.
  • Browser sandboxing is your trust boundary. If your browser is compromised, this tool cannot save you — use an offline machine for high-value keys.
Ready