PGP Key Pair Generator

Generate a real OpenPGP (PGP) key pair — a public key and a private key — for encrypting email, signing files and commits, and proving your identity. Fill in an email address, pick a key type, and generate; copy or download the armored keys straight from the result.

What is PGP used for?

PGP (Pretty Good Privacy, standardized as OpenPGP in RFC 4880) is the classic public-key system behind encrypted email and verified software releases. Your public key is meant to be shared — anyone can use it to encrypt a message only you can read, or to check a signature you made. Your private key stays secret; it's what you use to decrypt incoming messages and to sign outgoing ones. Common uses today include encrypted email (with clients like Thunderbird/Enigmail or Mailvelope), signing Git commits and tags so GitHub/GitLab show a "Verified" badge, and signing release artifacts so downloaders can confirm they haven't been tampered with.

Choosing a key type

• ECC Curve25519 (the default here) — a modern elliptic-curve key pair: small, fast to generate, fast to use, and the option OpenPGP.js itself recommends by default today. Supported by current GnuPG, Sequoia, and most modern PGP clients.
• RSA-2048 / 3072 / 4096 — the traditional choice, still the safest pick if you need compatibility with an older PGP client or a policy that specifically requires RSA. Larger sizes are slower to generate but not meaningfully more useful for most people — 2048-bit is still a reasonable modern minimum.

Passphrase and expiration

An optional passphrase encrypts the private key at rest, so a copy of the file alone isn't enough to use it — you'll need to remember (or store) the passphrase to unlock it later in a PGP client. Expiration sets when the key stops being valid; "Never" is fine for a personal key you'll actively manage, while a fixed expiry (1, 2, 5 years, or a custom number of days) is common for organizational keys that get rotated on a schedule.

Your private key never leaves your browser

Key generation runs entirely client-side, using the well-known OpenPGP.js library and your browser's built-in WebCrypto engine. Nothing you type — your name, email, passphrase, or the generated private key — is ever sent to any server; refresh the page and it's gone unless you copied or downloaded it first. Treat the private key like a password: store it in a password manager or an encrypted backup, and never paste it into a service you don't fully trust.

What do I do with the keys afterward?

Import the private key into a PGP-capable client (GnuPG, Thunderbird, Mailvelope, Keybase) to start decrypting and signing; publish the public key on a keyserver or share it directly with people who want to send you encrypted messages. The Key ID and fingerprint shown alongside the keys are how others verify they have the right public key for you — compare the fingerprint over a separate trusted channel before relying on a key you received from someone else.

Related tools

If you need a general-purpose asymmetric key pair rather than specifically OpenPGP — for TLS, JWT signing, or generic public-key crypto — see the RSA Key Generator. For a keypair to authenticate with a server over SSH, use the SSH Key Generator, which also offers modern Ed25519 keys in native OpenSSH format.