PGP Encryption Tool — Generate Keys, Encrypt, Decrypt, Sign and Verify
Generate an OpenPGP key pair (Curve25519 or RSA), encrypt and decrypt messages, and sign or verify a signature. Free, in your browser, no upload.
1. Generate a key pair
Optional, but recommended: a passphrase encrypts the private key so a stolen copy is useless without it. You will need it to decrypt.
Keys are fast ECC keys on Curve25519 — they generate almost instantly and import into GnuPG and other PGP tools.
2. Encrypt a message
3. Decrypt a message
4. Sign a message
A signed message is not secret — anyone can read it. The signature proves it came from you and that nobody changed a character of it.
5. Verify a signature
🔒 Keys and messages are generated and processed entirely in your browser — nothing is uploaded.
Public-key encryption, entirely in your browser
PGP (Pretty Good Privacy) lets two people exchange secret messages without ever sharing a password first. This tool does the five things a PGP workflow needs: generate an OpenPGP key pair, encrypt a message to someone’s public key, decrypt a message with your private key, sign a message so anyone can prove it is yours and unaltered, and verify somebody else’s signature. A message can be signed as it is encrypted, and the signature checked as it is decrypted. It is built on OpenPGP.js, the same library used in production webmail clients, so the ASCII-armored keys and messages it produces interoperate with GnuPG and other standard PGP software.
How public and private keys work together
Every key pair has two halves. Your public key is meant to be shared — anyone can use it to encrypt a message that only you can open. Your private key stays secret; it is the only thing that can decrypt those messages, and you can protect it further with a passphrase. To send someone an encrypted message you paste their public key; to read a message sent to you, you paste your private key. Because the underlying maths is asymmetric, a public key can lock but never unlock, which is exactly why it is safe to publish.
Curve25519 by default, RSA when you need it
Keys are elliptic-curve keys on Curve25519 by default rather than RSA. RSA key generation can freeze a browser tab for several seconds while it searches for large primes; Curve25519 keys generate almost instantly and offer equivalent modern security. They use the classic EdDSA and ECDH format, so they import cleanly into GnuPG, Thunderbird and other PGP tools. If your correspondent’s software can only read RSA, pick RSA 2048 or RSA 4096 from the Algorithm list — generation then takes seconds rather than an instant, which is the trade the choice exists for. You can also give the key an expiry (1, 2, 4 or 8 years) and a comment inside the user ID, and the fingerprint is printed under the public key so two people can check by voice that they hold the same key.
Private by design
Key generation, encryption and decryption all run locally in JavaScript — your keys, passphrase and messages never leave your device and nothing is uploaded, so the tool works offline and needs no sign-up. One caveat: browser-generated keys are ideal for everyday and learning use, but for high-value, long-lived identities you should generate and store keys on a trusted machine or hardware token, and always keep your private key and passphrase secret. A lost private key or passphrase cannot be recovered.
Frequently asked questions
Which key do I share, and which do I keep secret?
Share your public key freely — people use it to encrypt messages to you, and it can only lock, never unlock. Keep your private key secret: it is the only thing that can decrypt those messages. If you set a passphrase, you also need it every time you decrypt, so store both safely. A lost private key or passphrase cannot be recovered, and the messages stay unreadable.
Are my keys or messages uploaded anywhere?
No. Key generation, encryption and decryption all happen locally in your browser with OpenPGP.js. Your keys, passphrase and plaintext never leave your device and nothing is sent to a server, which is why there is no sign-up and the tool keeps working offline.
Will these keys work with GnuPG and other PGP software?
Yes. The tool outputs standard ASCII-armored OpenPGP keys and messages, so you can import the keys into GnuPG, Thunderbird or any RFC-compliant PGP app and encrypt or decrypt there. The keys use Curve25519 (EdDSA/ECDH), which modern PGP tools support, and RSA 2048/4096 is there for software too old for that.
Can I sign a message without encrypting it?
Yes. Step 4 signs your text with your private key and gives back a cleartext-signed message anyone can read; the signature proves it came from you and that not a character has changed. Step 5 checks such a message against the signer's public key and says whether it is genuine. You can also tick 'Sign it with my private key too' while encrypting, and 'Check the sender's signature' while decrypting.