PGP Encryption Tool — Encrypt & Decrypt

PGP lets you send a message that only one person can read, and sign one so anyone can check it came from you. The usual way in is GnuPG on the command line. This page does the same work in a browser tab, in the same format, so a message encrypted here opens in GnuPG, Thunderbird or Kleopatra, and the other way round.

How to Use the Five Tabs

1. New key pair: enter a name or email and a passphrase of at least 8 characters, choose ECC Curve25519 or RSA 4096, and download both keys. Share the public one; keep the private one.
2. Encrypt: paste the recipient’s public key, or several to reach more than one person, type the message and press Encrypt. Optionally sign it with your own private key too.
3. Decrypt: paste your private key and passphrase and the message beginning -----BEGIN PGP MESSAGE-----. Add the sender’s public key to check their signature.
4. Sign and Verify: make a cleartext signature, or check one against the signer’s public key.

Paste a key and its details appear underneath: the name and email, algorithm, creation and expiry dates and the 40-character fingerprint. Compare the fingerprint with the owner over a phone call or in person before trusting a key, because anyone can make a key with any name on it.

Format Notes: Keys, Messages and Compatibility

Everything is ASCII-armored text, the blocks that begin -----BEGIN PGP. The encryption is OpenPGP.js 5.11.2, the library behind Proton Mail’s web app, implementing RFC 4880. Messages and signatures made here were checked against GnuPG 2.4.8 in both directions, including signed and encrypted messages and text in Bangla. ECC keys are made in well under a second and are short; RSA 4096 takes a couple of seconds and suits older software that lacks Curve25519. A wrong passphrase says “That passphrase doesn’t unlock this private key.”, and a message encrypted for someone else says so rather than failing silently.

When Not to Use a Browser Tab for PGP

Nothing you type here is saved or sent: only the open tab and the key type are remembered. The library is loaded from jsDelivr and checked against a fixed SHA-384 hash, so the browser refuses a file that has been altered. Even so, a web page is a weaker home for a long-term private key than a hardware key or a desktop app, because any browser extension that can read pages can read what you paste. Use this for occasional messages, for learning, or for making a key you then move into a proper keyring, and keep the private key and passphrase somewhere safe offline: lose either and messages encrypted to you cannot be recovered.