If set, the private key is encrypted with it. Forget it and the key is unusable.
ECC Curve25519 — recommended: fast, modern, small keys.
Keep your private key safe. If lost, it cannot be recovered. Keys are generated entirely in your browser and never sent anywhere — download them or they are gone.
What it does
The PGP Key Generator creates OpenPGP key pairs — a public key you share with anyone who wants to send you encrypted mail or verify your signatures, and a private key you keep secret. It also produces a revocation certificate: a pre-made signature that marks the key as retired if it is ever lost, stolen, or compromised. Key generation runs 100% in your browser (via OpenPGP.js) — your private key is never transmitted, logged, or stored anywhere.
You choose between ECC (Curve25519) — the modern default: fast to generate, small keys, strong security — and the classic RSA in 2048- or 4096-bit sizes for compatibility with older OpenPGP implementations. An optional passphrase encrypts the private key at rest, so a stolen key file alone cannot be used.
How to use it
- Enter your Name and Email — they become the key’s user ID (
Ada Lovelace <ada@example.com>). - Optionally set a Passphrase. It encrypts the private key; forget it and the key is unusable. Use the eye toggle to show it.
- Pick an Algorithm: ECC (recommended), RSA 2048, or RSA 4096 (generation can take a few seconds).
- Press Generate key pair and wait for the spinner to finish.
- Copy or Download your public key (
public-key.asc) — share this one freely. - Copy or Download your private key (
private-key.asc) — store it somewhere safe. - Expand Revocation certificate and download it (
revocation-cert.asc). Print it and store it offline for emergencies.
Examples
An ECC identity key
Input: name Ada Lovelace, email ada@example.com, algorithm ECC, no passphrase.
Output (truncated):
-----BEGIN PGP PUBLIC KEY BLOCK-----
xjMEZ9xKchYJKwYBBAHaRwBA9D4A5FSsD3vE…
=mBdA
-----END PGP PUBLIC KEY BLOCK-----
Fingerprint: 9A4C 82B1 6C9E 03F2 4721 88AB D05F 33E1 7C42 6019An RSA-4096 key with a passphrase
Input: name Ada Lovelace, email ada@example.com, passphrase correct horse battery staple, algorithm RSA 4096 → a -----BEGIN PGP PRIVATE KEY BLOCK----- that asks for the passphrase when imported into GnuPG.
A revocation certificate
-----BEGIN PGP PUBLIC KEY BLOCK-----
Comment: This is a revocation certificate
…
-----END PGP PUBLIC KEY BLOCK-----Good to know
- ECC vs RSA: ECC Curve25519 keys are ~300 bytes armored and generate in milliseconds; RSA-4096 keys are several kilobytes and can take tens of seconds in a browser. Both are considered secure; pick RSA only when you must interoperate with very old OpenPGP software.
- Revocation certificate: publish it to a keyserver (or give it to a friend) only when you want to retire the key. Anyone holding it can revoke the key — that is its power and its risk.
- Private: runs 100% client-side. Refreshing the page without downloading discards the key permanently — by design.
- Related tools: PGP Encrypt/Decrypt, SSH Key Generator,
HashHashA one-way function that maps data of any size to a fixed-length digest. Same input, same digest; any change, different digest; not reversible.
Generator, Passphrase Generator.