Free Online PGP Key Generator
Create OpenPGP key pairs for signing and encrypting email, files and Git commits. Choose Curve25519 (v4 or the newer RFC 9580 v6 format), NIST curves or RSA, set an expiry, protect the private key with a passphrase, and get a revocation certificate and a self-test result.
100% client-side · OpenPGP.js built in · Nothing is stored or sent
Key strength uses NIST estimates of security bits. The passphrase figure assumes random characters, so a passphrase you made up is weaker than it shows.
No keys yet. Create a key pair on the Generate tab.
Paste a public key to see its fingerprint, algorithms, owner and expiry. Never paste a private key into any website: this page refuses to read it.
How the PGP Key Generator Works
An OpenPGP key is a small bundle of signed packets. This page asks your browser’s cryptographic random number generator for the secret material, builds a primary key for signing and certifying, adds a separate encryption subkey, signs your name and email onto it, and finishes with a revocation certificate. Your fingerprint is a hash of the public key, so it changes if any part of the key changes. If you set a passphrase, the private key is encrypted with it before it is written out.
After generation the page signs and verifies a test message and encrypts and decrypts another one, to show that the new pair really works. The cryptography comes from OpenPGP.js 6.3.2 (LGPL-3.0), which is included in this page, so no outside code is loaded and no network request is made.
Browser-Only Generation
OpenPGP.js is built into this page: no outside scripts and no network requests
Modern Key Formats
Curve25519 as v4 or RFC 9580 v6, NIST curves and RSA
Stronger Key Protection
Standard AES-256 protection, or AEAD with Argon2id for the private key
Strength Figures
NIST-based key strength, a passphrase estimate and the expiry date
Revocation and Self-Test
A revocation certificate, plus a sign, verify, encrypt and decrypt check
True Binary Export
ASCII or real binary (.gpg) files, and a public key inspector
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is PGP and what do I use it for?
PGP (Pretty Good Privacy) is the best-known implementation of the OpenPGP standard, now published as RFC 9580. A key pair lets you sign messages and files so others can check they came from you, and lets others encrypt messages that only you can read. It is used for email, file encryption, software releases and signing Git commits.
2. Is this PGP key generator secure?
The keys are created in your browser by OpenPGP.js, an open-source library included in this page, using your browser’s cryptographic random number generator. The page makes no network requests, loads no outside scripts and saves nothing. Your private key is shown on screen, so use a device you trust, save the key, then press Clear keys. The page also clears the keys after 10 minutes without activity.
3. Which algorithm should I choose?
Curve25519 (v4) is the recommended default: keys are small and fast, with about 128 bits of security, and current GnuPG, Thunderbird and most OpenPGP tools support it. Curve25519 (v6) uses the newest RFC 9580 format and suits software you know supports it. NIST P-384 and P-521 give about 192 and 256 bits. RSA is for older software: 3072 bits gives about 128 bits, 4096 bits about 140 and 2048 bits about 112, the legacy minimum (NIST estimates).
4. What is the difference between v4 and v6 keys?
Version 6 keys from RFC 9580 are identified by a 64-character SHA-256 fingerprint instead of the 40-character SHA-1 fingerprint of v4, use Ed25519 and X25519 natively, and are built for modern protection of the secret key. Software that only knows the older standard cannot read them, so check your tools before choosing v6. If in doubt, choose v4.
5. Should I protect my private key with a passphrase?
Yes. Without one, anyone who obtains the key file can use your key. The page estimates the passphrase strength and points you to 80 bits or more, which five or more random words can give. Standard protection (AES-256 with an iterated, salted key derivation) works everywhere. Modern protection uses AEAD with Argon2id, which is far harder to attack with graphics cards, but only newer software can open it.
6. Why should my key expire?
An expiry date limits the damage if you lose a key and cannot revoke it. One to two years is common, and you can extend the date later with your private key. The default here is two years, so choose Never only if you are sure.
7. What is a revocation certificate?
It is a ready-made statement that your key must no longer be trusted. If you lose your private key or forget its passphrase, you can still publish the certificate to retire the key. Store it separately from the private key, offline if possible, and use it only when you need to revoke the key.
8. How do I share my public key?
Send the public key file, publish it on your website, or upload it to a key server such as keys.openpgp.org. Share the fingerprint through a second channel so people can check that the key is really yours. Never share the private key.
9. How do I import the keys into GnuPG or Thunderbird?
In GnuPG, run gpg --import followed by the file name, for either the .asc file or the binary .gpg file. Thunderbird’s OpenPGP Key Manager has an option to import keys from a file. Import the revocation certificate only when you really want to revoke the key.
10. What do the self-test and the Inspect tab do?
After creating the keys, the page signs and verifies one test message and encrypts and decrypts another with the new key, to show that the pair works. The Inspect tab reads a public key that you paste and shows its fingerprint, algorithms, owner and expiry, so you can check a key someone sends you. It refuses to read private keys.