1999.LOC

PGP is what journalists and security teams have used for thirty years to send things nobody else can read. People paste their private keys into unknown websites to do it; this page has no server to paste them to. Every other “encrypt a file online” service asks you to upload the private thing, and the password, to their machine. Turn off your wifi after this page loads and it still works.

Encrypt a message or a file to someone’s key, or lock a file with a password. Both write the same OpenPGP; nothing is uploaded.

This is real OpenPGP, done properly, in your browser. But a browser tab is not a hardware token and this page is not GnuPG. If you are protecting a source, a disclosure, or anything where being wrong has consequences for a person, use a desktop tool with a key on a device that is not also running a hundred other tabs. This is for the enormous middle ground: sending a colleague something private, checking a signature, and learning how any of it works without handing your key to a stranger.

Is this actually private?

• Nothing is uploaded. Static page, no endpoint, no account, no keyserver. Your private key is generated in the tab and stays there.
• A private key is never stored here without a passphrase. Local storage is convenient and it is not a vault: anything running as this site's origin could read it, and clearing your browsing data deletes it. With a passphrase, what is in there is a block that costs a real search to open. Without one it would be the key itself. So a key made without a passphrase is downloaded and not kept, and a private key imported without one is locked with a passphrase you give before it is stored. Export anything you want to keep, and put the export somewhere you actually back up.
• The passphrase is stretched, and how far depends on the format. Compatible keys use 65,011,712 rounds of SHA-256, which is the most the older format allows. Modern keys use Argon2, which is memory-hard: the reason that matters is that a graphics card can run billions of hashes a second but cannot cheaply give each of them its own megabytes of RAM, so the same money buys an attacker far fewer guesses.
• Two formats, and the newer one is not the default. RFC 9580 arrived in 2024 with authenticated encryption, version 6 keys and Argon2. All of it is better and none of it is universally readable yet, so the compatible format is what you get unless you choose otherwise. Both use the same Ed25519 and X25519 underneath; what differs is the packet encoding and the passphrase stretching. The page prints exactly what each will produce before you make anything, and the test suite generates real keys with those settings and reads the algorithms back out, so those sentences cannot quietly drift out of true.
• Which format a message gets is decided by the recipient, not by you. Encrypting to a version 6 key gives authenticated encryption; encrypting to an older key gives the older format even with the modern setting chosen. That is the library refusing to write something the recipient could not open, and it is right to, but it does mean the toggle governs the keys you make rather than every message you send.
• A browser tab is not GnuPG. The cryptography is the same and the files are interchangeable, but the surroundings are not: a desktop tool keeps your key out of a process that also renders web pages. For work where being wrong has consequences for a person, use GnuPG and a hardware token. This page is for the very large space of things that are private but not perilous.
• Curve25519 by default, RSA if you need it. Curve25519 keys are tiny, generate in a fraction of a second, and are supported by every current implementation. RSA 4096 takes several seconds to generate and is what to pick if the person on the other end is running something very old.
• Everything is standard OpenPGP. Keys made here import into GnuPG, Kleopatra, GPG Suite, Thunderbird and Proton Mail. Messages encrypted here decrypt there and the reverse. This page is a convenience, never a dependency.
• Verification needs their key, and their key needs checking. A signature only tells you the message matches a key. That the key belongs to the person you think it does is a separate question, and the only real answer is comparing the fingerprint with them through some channel an attacker does not also control.
• Take your keys with you. Any key saves out as a .asc, a pair saves as one file with the public half first, and the whole keyring saves in one go. Import works the other way: paste a key, or open a file, and a file holding several keys imports all of them rather than the first. Nothing here is a place your keys have to live.
• What it does not do: keyservers, the web of trust, revocation certificates, subkey editing, and encrypting to more than one recipient at a time. An expiry can be set when a key is made but not changed afterwards. Those are real PGP features and this is deliberately the small end of it.
• It downloads about 390 KB the first time you open this tab: OpenPGP.js, LGPL, served unmodified from this domain. The one library here that exists because writing it ourselves would be reckless.

• Nothing is uploaded. Static page, no endpoint, no account. Neither the file nor the password leaves the tab, and there is nowhere for them to go.
• The output is OpenPGP, symmetric mode. The same thing gpg --symmetric produces: your password is stretched into a key, a random session key encrypts the data, and the result is a file any OpenPGP implementation can read. AES-256, and a file that has been tampered with fails to open rather than decrypting into something subtly wrong.
• It is the older format, and that is the choice. This tab used to say “an authenticated mode”, which was not accurate and has been corrected. What it writes is AES-256 in CFB with a modification-detection code appended, and your password stretched through 65,011,712 rounds of SHA-256, the most the older format allows. Tampering is caught either way, but the check happens after decrypting rather than as part of it. OpenPGP has had genuine authenticated encryption since RFC 9580 in 2024, along with Argon2 in place of that SHA-256 loop, and both are better. Neither is written here, because a great deal of installed software cannot read them yet and a file the recipient cannot open is not a stronger file. Make a key offers the newer format as a deliberate choice, where you know who is opening it.
• The password is the whole of the security. There is no key file, no second factor and no server-side rate limit, so an attacker with the file can guess at it as fast as their hardware allows. That is why the meter above is pessimistic and why a suggested passphrase is worth taking. Eight words from the list is 64 bits, which nobody is guessing. The list is published on this page, so those are its real bits, not the flattering number you get by counting the letters.
• There is no recovery. Nothing here stores the password, so nothing here can help you if it is forgotten. This is not a policy that could be relaxed; it is what the encryption is.
• The filename is kept inside the file, not on it. Locking report.pdf gives report.pdf.gpg, and unlocking gives report.pdf back even if somebody renamed the locked file on the way. The name is inside the encryption, so a person who intercepts it does not learn what you sent.
• The size still shows. Encryption hides the contents, not the fact that you sent a four megabyte file to someone. If that matters, padding it is on you.
• It downloads about 390 KB the first time: OpenPGP.js, served from this domain. It is the one library here that exists because writing it ourselves would be reckless: a cipher that is subtly wrong looks exactly like one that is right, and nobody holding the file could tell.
• Everything is in memory. A very large file will run a tab out of memory. There is no streaming mode here yet.

Hosted on Cloudflare · Made with spite for bloat
inspect a file | open a zip | edit a pdf | check an email | source

Nothing here is for sale, nothing is tracked, and there is no account to make. If something saved you an hour:
83TQcTwusSQ4WKbPQE5osrF3cR4GWe2zmcNWeozK6BSqHSaeLvjUVe476ouVwLKn1uVwEFcbJQvnme7W6dTV5SB93x45DEy
You can check that address here before sending anything.