PGP Encrypt & Keygen

Generate PGP keys and encrypt locally.

Runs locally in your browser Report an issue
Message No signup · local processing

Generate PGP keys and encrypt, locally

Generate a modern PGP keypair in your browser, then encrypt a message so only the holder of the private key — or anyone with a shared passphrase — can read it. Paste back any armored PGP block to decrypt it with your key or password. OpenPGP.js runs the cryptography entirely on your device, so your private key, passphrase, and plaintext never touch a server. Copy the armored keys and ciphertext to share them however you like.

Common questions

Does my private key or passphrase leave my device?

No. All key generation, encryption, and decryption run in your browser through OpenPGP.js. Keys, passphrases, and plaintext are held only in the page's memory and are never uploaded or stored — close the tab and they are gone.

What is the difference between passphrase and key encryption?

Passphrase (symmetric) encryption locks the message with a password that both sides must know — simple for a quick secret you can share the password for separately. Key (asymmetric) encryption uses the recipient's public key so only their private key can decrypt it, with no shared secret to leak.

What kind of keypair does it generate?

A modern elliptic-curve (Curve25519) PGP keypair by default, which is fast and compact, with RSA 2048/4096 available if you need compatibility with older tools. The private key is itself protected by a passphrase you choose.

Can I use keys made in another PGP tool?

Yes. Paste any standard armored PGP public key to encrypt to it, or an armored private key (plus its passphrase) to decrypt. The tool is interoperable with GnuPG and other OpenPGP implementations.

Is it safe to use for real secrets?

The cryptography is the well-reviewed OpenPGP.js library running locally. As with any crypto tool, your security depends on keeping your private key and passphrase safe and on verifying you have the correct recipient public key. For high-stakes use, a vetted desktop client you fully control is still prudent.