PGP Encryption Tool (OpenPGP)
Encrypt a message to one or more OpenPGP public keys, decrypt with your private key, or generate a Curve25519/RSA key pair. ASCII-armored, runs in your browser.
Paste one or more ASCII-armored public key blocks. Every recipient listed can decrypt the message.
Runs entirely in your browser. Your data is never uploaded.
What is PGP Encryption?
Encrypts text to one or more recipients' OpenPGP public keys and returns an ASCII-armored BEGIN PGP MESSAGE block that GnuPG, Kleopatra, Thunderbird or ProtonMail can decrypt. The page also decrypts messages with your private key and generates new key pairs for testing, using the openpgp.js library.
How to use PGP Encryption
- On the Encrypt tab paste one or more recipient public keys (
BEGIN PGP PUBLIC KEY BLOCK); the user IDs and fingerprints are shown so you can check them. - Write the Message and click Encrypt, then copy or download the armored message.
- To read a message, open Decrypt, paste your private key, its passphrase (if any) and the message, and click Decrypt.
- No key yet? Use Generate key pair, enter a name or email and optional passphrase, then click Use public key for encryption.
Example
Message "Hello PGP" encrypted to a Curve25519 public key for "Test Recipient <test@example.com>"
-----BEGIN PGP MESSAGE----- … -----END PGP MESSAGE-----
The armored message differs on every run because a new random session key is used; decrypting it returns "Hello PGP".
When to use PGP Encryption
Use it to send a confidential message to someone who publishes a PGP key, to test PGP integration or to try OpenPGP without installing software. For daily use, keep your private key in a local client such as GnuPG; a browser page is not the right place for long-term private keys. The tool does not sign messages or verify signatures.
How PGP Encryption works
OpenPGP (RFC 4880/9580) uses hybrid encryption: a random session key encrypts the message with AES, and that session key is encrypted to each recipient's encryption subkey (ECDH on Curve25519 or RSA). The packets are Base64-armored with a CRC checksum. Decryption unlocks the private key with its passphrase, recovers the session key and verifies the integrity-protected data packet. Key generation creates a primary signing key and an encryption subkey (Curve25519 or RSA-4096) bound to your user ID.
Common Use Cases
- Encrypt a message for a security contact's published PGP key (security.txt)
- Test that your server's GnuPG setup can decrypt OpenPGP.js output
- Encrypt the same message for several recipients at once
- Generate throwaway key pairs for demos and tutorials
Security Note
All encryption, decryption and key generation happen in your browser; nothing is uploaded. Generated private keys are not stored – save them yourself – and avoid pasting long-term private keys into any web page.
FAQs
Can GnuPG decrypt the output?
Yes. Save it as message.asc and run gpg --decrypt message.asc with the recipient's key in your keyring.
Which key type should I generate?
ECC Curve25519 is fast, compact and supported by GnuPG 2.1+ and all modern clients. RSA 4096 gives maximum compatibility with very old software but is slower.
Is the message signed?
No, it is only encrypted. Recipients cannot tell who sent it; sign it with your own client if authenticity matters.
What if I lose the passphrase of my private key?
The key cannot be used any more and messages encrypted to it cannot be read. There is no recovery.