Developer

PGP Encrypt / Decrypt

Encrypt, decrypt, generate PGP key pairs, and sign/verify messages in-browser with OpenPGP.js.

Loading interactive tool…

Embed this tool on your site

About this tool

PGP (Pretty Good Privacy) is a proven standard for end-to-end encrypted communications. This tool brings the core OpenPGP workflow to your browser using OpenPGP.js 5.11.2 — the library maintained by Proton for its mail apps. Four tabs cover the PGP lifecycle: Encrypt a message using a recipient's public key so only they can read it; Decrypt a ciphertext using your private key and optional passphrase; Generate a fresh key pair (ECC ed25519 for modern use, or RSA 2048/4096 for broad compatibility); and Sign a message or Verify a signed message. Signing produces an inline-signed message in a -----BEGIN PGP MESSAGE----- block, and Verify accepts that format; cleartext-signed (BEGIN PGP SIGNED MESSAGE) and detached signatures are not supported. The library is downloaded from unpkg on first use; keys, passphrases and messages are processed in your browser and never sent to a server.

Why use it

  • Keys, passphrases and messages are processed client-side by OpenPGP.js and never sent to any server.

  • Supports modern ECC (ed25519) and legacy RSA 2048/4096, covering all common interoperability needs.

  • The Verify tab lets you check signatures made with the Sign tab or OpenPGP.js without installing GPG.

  • Generate and download key pairs in standard ASCII armor format accepted by all PGP tools.

  • Useful for testing PGP integrations, onboarding users to encrypted workflows, and learning the OpenPGP standard.

How to use

  1. To encrypt: paste the recipient's public key block (-----BEGIN PGP PUBLIC KEY BLOCK-----) in the Encrypt tab, type your message, and click Encrypt to get the ASCII-armored ciphertext.
  2. To decrypt: paste your private key, enter your passphrase if the key is protected, paste the ciphertext, and click Decrypt.
  3. To generate a key pair: go to Generate Keys, choose ECC (recommended) or RSA, enter a name and email, set an optional passphrase, and click Generate Key Pair. Download both keys.
  4. To sign a message: open Sign / Verify, paste your private key, enter the passphrase if needed, type the message, and click Sign.
  5. To verify: switch to Verify, paste the signer's public key and a signed PGP MESSAGE block, then click Verify Signature — a green badge confirms a valid signature, and a wrong key or altered message shows an error.

When it helps

  • Encrypting sensitive messages to send over email, chat, or a public paste link where only the named recipient should be able to read it.
  • Testing PGP encryption/decryption logic in a backend service.
  • Generating key pairs for a new user or service without installing GPG locally.
  • Checking that a message signed with OpenPGP.js or this tool's Sign tab is authentic.
  • Learning OpenPGP workflows before integrating a library into your application.

Examples

Encrypting a sensitive message to a recipient

Input
Recipient public key: -----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEY3...
-----END PGP PUBLIC KEY BLOCK-----
Message: The deploy key for prod is in 1Password under prod-deploy
Expected result
-----BEGIN PGP MESSAGE-----
hQEMAyM...
-----END PGP MESSAGE-----
(only the recipient's private key can decrypt this)

Generating an ed25519 key pair for a new contributor

Input
Name: Alice Example
Email: alice@example.com
Key Type: ECC (ed25519)
Passphrase: (set a strong passphrase)
Expected result
Two ASCII-armored blocks: a public key (about 640 characters, share this) and a private key (about 860 characters with a passphrase, keep secret). Download them as public-key.asc and private-key.asc.

Signing and verifying a short message

Input
Sign tab: your private key + message "v2.4.0 is now available"
Then Verify tab: your public key + the signed output
Expected result
Sign outputs a -----BEGIN PGP MESSAGE----- block; Verify shows “✓ Valid signature — message is authentic”.

Decrypting a paste link sent by a colleague

Input
Your private key: -----BEGIN PGP PRIVATE KEY BLOCK-----
...
Passphrase: ********
Ciphertext: -----BEGIN PGP MESSAGE-----
hQEMAyM...
Expected result
Decrypted plaintext appears in the output panel: 'AWS_ACCESS_KEY=AKIA...; AWS_SECRET=...' — only readable by the holder of this specific private key.

Tips

  • Generate a dedicated test key pair for experimenting before using this tool with important keys; throwaway keys make it easy to validate workflows without risking real identities.
  • ECC ed25519 is the recommended choice for new key pairs — keys are tiny, operations are fast, and modern OpenPGP tools all support it. Choose RSA 4096 only when forced by legacy interop.
  • Always protect private keys with a strong passphrase, especially if you download and store them. The passphrase encrypts the private key on disk so a stolen .asc file is not immediately usable.
  • Compare key fingerprints out-of-band (phone call, in person, or a separate trusted channel) before trusting a public key to belong to a specific person.
  • Sign-then-encrypt is the canonical workflow for sensitive correspondence: signing inside the encrypted envelope ensures the recipient knows exactly who sent the message and that it has not been altered.
  • Save your generated private key somewhere safe (encrypted password manager, hardware token, or offline backup) the moment it is created — closing the tab without downloading means the key is gone forever.

Frequently Asked Questions

Is it safe to paste my private key into this tool?
Keys and messages are processed in your browser and are not sent to any server; the only network request is the one-time download of OpenPGP.js from unpkg. However, for maximum security, avoid using your primary personal private key in any online tool — create a test key pair here first and use that for experimentation.
What is the difference between ECC and RSA key types?
ECC (specifically ed25519) produces much smaller keys and is significantly faster than RSA while offering equivalent security. RSA is older and more widely supported by legacy systems. For new use cases, ECC is recommended; choose RSA only if your target system requires it.
What does ASCII armor mean?
ASCII armor is the base64-encoded text format for PGP data, enclosed in -----BEGIN PGP ... BLOCK----- headers. It allows binary cryptographic data to be transmitted in plain-text systems like email or copy-paste.
Can I use a key I generated here with real GPG software?
Yes. Keys generated in OpenPGP.js format are fully compatible with GnuPG (gpg), Kleopatra, ProtonMail, and any other OpenPGP-standard tool. Download the key files and import them with gpg --import.
Why does the Decrypt operation fail even with the right key?
The most common reason is a mismatched passphrase or using the public key instead of the private key. Ensure you paste the PRIVATE key block (-----BEGIN PGP PRIVATE KEY BLOCK-----) in the Decrypt tab.
What is the difference between encrypting and signing?
Encryption ensures only the recipient can read the message (confidentiality). Signing proves the message came from you and was not tampered with (authenticity). Both can be combined in PGP, but this tool encrypts and signs in separate steps.
Can it verify a GnuPG --clearsign message?
No. Verify only reads inline-signed messages in a -----BEGIN PGP MESSAGE----- block, such as those made by the Sign tab. A -----BEGIN PGP SIGNED MESSAGE----- block fails with “Armored text not of type message”.

Explore the category

AES Text Encryptor PBKDF2-hardened AES-GCM encrypt and decrypt. RSA Key Generator Issue RSA-OAEP 2048 PEM pairs via Web Crypto. SSH Public Key Fingerprint Calculate the SHA-256 fingerprint of an SSH public key in Base64 and hex to verify identity without sharing the full key. bcrypt Generator & Verifier Hash passwords with bcrypt (cost 8–14) and verify hashes in-browser. Hash Generator Generate SHA-256, SHA-1, MD5 hashes UUID Generator Generate random UUIDs v4
How PGP Encryption Works: Keys, Trust, and Real-World Use PGP (and OpenPGP) has secured email and files since 1991. We explain key pairs, the web of trust, signing vs encrypting, and where PGP still Mar 2026 · 8 min

Glossary

OpenPGP
The open standard (RFC 4880) for PGP encryption and signing, implemented by tools like GnuPG, OpenPGP.js, and many email clients. PGP is the brand; OpenPGP is the spec.
Public-key cryptography
An asymmetric scheme where each user has a key pair: the public key encrypts and verifies, the private key decrypts and signs. Knowing the public key reveals nothing about the private key.
ASCII armor
Base64 encoding of binary PGP data with human-readable -----BEGIN/END----- header lines, enabling PGP data to travel safely through plain-text channels like email and chat.
Key ring
A local collection of OpenPGP keys you trust or own. GnuPG stores public keys in pubring.gpg/pubring.kbx and private keys in secring.gpg/private-keys-v1.d. This tool does not maintain a persistent key ring.
Web of trust
A decentralized PGP trust model where users sign one another's keys to attest identity, building a graph of vouched relationships. An alternative to centralized certificate authorities.
RSA vs ECC
RSA is an integer-factorization-based algorithm (key sizes 2048–8192 bits); ECC (elliptic curve, curve25519/ed25519) provides equivalent security with 32-byte keys. ECC is faster, smaller, and recommended for new keys.
Passphrase
A secret used to encrypt a private key on disk. Without the passphrase, a stolen private key file cannot be used. Required when decrypting or signing with a passphrase-protected key.
Fingerprint
A short hash of a public key (typically 40 hex characters for SHA-1, 64 for SHA-256) used for out-of-band identity verification — easier to compare by phone or in person than a full key block.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities