Keys, messages and files. Your private key never leaves this tab.
PGP is the thing journalists, maintainers and security teams have used for
thirty years to send each other something nobody else can read. It is also
notoriously awkward, which is why people paste their private keys into websites
they know nothing about. This page has no server to paste them to.
Read this before you trust it with anything that matters.
This is real OpenPGP, done properly, in your browser. But a browser tab is not a
hardware token and this page is not GnuPG. If
you are protecting a source, a disclosure, or anything where being wrong has
consequences for a person, use a desktop tool with a key on a device that is not
also running a hundred other tabs. This is for the enormous middle ground:
sending a colleague something private, checking a signature, and learning how
any of it works without handing your key to a stranger.
Your keys
Kept in this browser only, in its local storage. Not synced, not uploaded,
and gone if you clear your browsing data — so export anything you want
to keep.
Make a new key pair
— protects the private key on this machine. Optional, but do it.
Import a key
Paste anyone's public key to send them things, or your own private key to use it here.
Encrypt
Decrypt
Sign
A signature proves the text came from you and has not been altered. It does
not hide anything — the message stays readable.
Verify
Paste a signed message. The signer's public key has to be in your keys above.
Is this actually private?
The honest notes
Nothing is uploaded. Static page, no endpoint, no account, no keyserver. Your private key is generated in the tab and stays there.
Keys live in this browser's local storage. That is convenient and it is not a vault: anything running as this site's origin could read it, and clearing your browsing data deletes it. Export anything you want to keep, and put the export somewhere you actually back up. A passphrase on the private key means what is stored is useless without it.
A browser tab is not GnuPG. The cryptography is the same and the files are interchangeable, but the surroundings are not: a desktop tool keeps your key out of a process that also renders web pages. For work where being wrong has consequences for a person, use GnuPG and a hardware token. This page is for the very large space of things that are private but not perilous.
Curve25519 by default, RSA if you need it. Curve25519 keys are tiny, generate in a fraction of a second, and are supported by every current implementation. RSA 4096 takes several seconds to generate and is what to pick if the person on the other end is running something very old.
Everything is standard OpenPGP. Keys made here import into GnuPG, Kleopatra, GPG Suite, Thunderbird and Proton Mail. Messages encrypted here decrypt there and the reverse. This page is a convenience, never a dependency.
Verification needs their key, and their key needs checking. A signature only tells you the message matches a key. That the key belongs to the person you think it does is a separate question, and the only real answer is comparing the fingerprint with them through some channel an attacker does not also control.
What it does not do: keyservers, the web of trust, key revocation and expiry management, subkey editing, and encrypting to more than one recipient at a time. Those are real PGP features and this is deliberately the small end of it.
It downloads about 390 KB the first time: OpenPGP.js, LGPL, served unmodified from this domain. The one library here that exists because writing it ourselves would be reckless.