Generate OpenPGP public and private keys in your browser
Use this free PGP key generator to create an OpenPGP (GPG) key pair locally.
Pick RSA or Curve25519, copy armored keys, inspect fingerprints, and download .asc files.
100% client-side. Your private key never leaves this tab.
Curve25519 | Fast default, modern ECC |
P-256 | NIST ECC, wide TLS overlap |
RSA 3072 | Solid RSA baseline |
RSA 4096 | Slower, common for GPG |
Email | Encrypt and sign messages |
Git | Verified commit signatures |
Release | Sign tarballs and checksums |
Chat | Identity in some messengers |
PGP (Pretty Good Privacy) and the OpenPGP standard use a public key and a private key. Anyone can encrypt to your public key or verify a signature. Only the private key decrypts or signs. GPG is the usual command-line implementation of that format.
Generate creates a new key pair and a revocation certificate in this tab. Inspect reads an existing armored block and shows fingerprint, Key ID, algorithm, User IDs, and expiry. Inspect never uploads the key.
Generation uses OpenPGP.js in your browser. Import a downloaded private key with gpg --import. For Git signing, see the Git config guide. Related tools: SSL Certificate Decoder, HMAC Generator, Hash Generator.
A PGP (Pretty Good Privacy) key is an OpenPGP public and private key pair used to encrypt messages, sign Git commits, and verify software. You share the public key. You keep the private key secret.
Enter a name and email, choose RSA or Curve25519, optionally add a passphrase, and click Generate keys. The armored public and private keys appear in your browser and are not uploaded.
This generator runs locally with OpenPGP.js. Keys are not sent to a server. Still treat the private key as a secret: use a passphrase, download it, then clear the page. For high-value keys, prefer gpg on a trusted machine.
Curve25519 is the usual default: smaller keys and faster generation. RSA 4096 is widely supported on older tools. RSA 2048 is still common but weaker than 3072 or 4096 for new keys.
The fingerprint is a hash of the public key, shown as grouped hex. Compare it out of band before you import someone else's key. GitHub, Keybase, and gpg --fingerprint all display the same value for a given key.
Save the private .asc file and import it with gpg --import key.asc. List it with gpg --list-secret-keys --keyid-format=long. For Git commit signing, set user.signingkey to the Key ID and enable commit.gpgsign.
No. It only generates and inspects keys. Use a mail client with OpenPGP support, or gpg --encrypt, to encrypt messages with the public key.
A revocation certificate lets you mark a key as withdrawn if the private key is lost or leaked. Generate it now, store it offline, and publish it later if you must retire the key.