PGP Encrypt / Decrypt
EncryptionProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool implements OpenPGP encryption, decryption, signing and verification using
openpgp.js. It follows the OpenPGP standard (RFC 4880), fully compatible with
GnuPG (GPG) and other PGP implementations. All cryptographic operations run locally in your browser — no data is sent to any server.
Hybrid Encryption Model
PGP combines two encryption techniques for both security and efficiency:
- Symmetric encryption: A random session key encrypts the actual message (fast, handles any size)
- Public-key encryption: The session key is then encrypted with the recipient's public key (secure key exchange)
- Only the recipient's private key can decrypt the session key and unlock the message
- When using password mode, the password replaces the public key — simpler but requires a secure channel to share it
Four Operations: Encrypt, Decrypt, Sign, Verify
- Encrypt: Lock a message with a recipient's public key or a shared password. Supports multiple recipients — each gets their own encrypted copy of the session key
- Decrypt: Unlock an encrypted message with your private key or the shared password. Optionally verify an embedded signature at the same time
- Sign: Attach a digital signature to prove the message came from you. Choose Cleartext Signature (message stays readable) or Detached Signature (separate binary signature)
- Verify: Confirm a signed message is authentic using the signer's public key. Detects tampering and identifies the signing key
ECC vs RSA: Which Algorithm?
The Key Generator supports both ECC (Curve25519) and RSA (2048–4096 bits) for key pair creation:
- ECC (Curve25519): Shorter keys and signatures, faster generation, equivalent security with smaller key sizes. Recommended for most users
- RSA: Traditional choice with broad legacy compatibility. Use 4096 bits for long-term security. Key files are larger but universally supported
- Both algorithms are fully interoperable with GnuPG and other OpenPGP implementations
Frequently Asked Questions
Can I use this with GnuPG (GPG) keys?
Yes. This tool uses the OpenPGP standard (RFC 4880), the same protocol implemented by GnuPG. Export your GPG key with "gpg --armor --export user@example.com" and paste it here. Messages encrypted in this tool can be decrypted with GPG, and vice versa.
Which algorithm should I choose — ECC or RSA?
ECC (Curve25519) is recommended for most users: it produces shorter keys and signatures, is faster to generate, and offers equivalent security to RSA with much smaller key sizes. RSA (2048–4096 bits) is the traditional choice and has broader legacy compatibility. If you are unsure, choose ECC.
What is the difference between public key and password encryption?
Public key encryption uses the recipient's public key — only their private key can decrypt. It is ideal for sending messages to specific people without sharing secrets beforehand. Password encryption uses a shared password that both sender and recipient must know — simpler but requires a secure channel to share the password. Choose public key for most use cases.
Is my private key safe in this tool?
All processing happens entirely in your browser. Your private key, passphrase, and messages never leave your device — there is no backend server. However, as a best practice, only use test or development keys with any online tool. Never paste production private keys into browser-based applications.
What is the Key Generator for?
The built-in Key Generator creates a fresh PGP key pair (ECC Curve25519 or RSA) directly in your browser. Generated keys can be downloaded as .asc files or used immediately in the Encrypt, Decrypt, and Sign modes via the "Use this key pair" button. This is useful for testing, learning, or generating keys for non-critical use cases.
Can I sign a message without encrypting it?
Yes. The Sign mode supports two formats: Cleartext Signature (the message stays readable with a signature block appended — ideal for emails and forum posts) and Detached Signature (a separate binary signature file — ideal for verifying file integrity). The recipient uses the Verify mode with your public key to confirm authenticity.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.