Generate a PGP Key Pair — Free OpenPGP Key Generator

Keeping your communications truly private starts with a single decision: generating a trustworthy PGP key pair. This pgp key pair generator gives you full control over your encryption and digital-signing credentials — producing an OpenPGP-compliant keypair directly inside your local session, with passphrase protection built in from the first keystroke. Whether you need to encrypt emails, secure file transfers, or establish authenticated workflows in a DevOps pipeline, understanding what your generated keys contain — and how to inspect, distribute, and protect them — is the foundation of sound cybersecurity practice.

Your Secure PGP Key Generator — Instant, Private, and Air-Gap Ready

This secure pgp key generator runs entirely in-browser with no data sent to any backend server, no keys transmitted over the network, and no session details written to a log file. The privacy & security notice is simple: your keys are generated locally, they never leave your device, they are never uploaded, never stored, and never logged. The only analytics touchpoint on this site is Google Analytics, used purely for aggregate visitor counts — no user tracking of key-related data takes place whatsoever. With no servers involved in the key generation process, your credentials remain entirely under your control.

The tool is powered by OpenPGP.js, an actively maintained, publicly auditable JavaScript implementation of the OpenPGP standard (defined in RFC 4880 and extended by RFC 6637). It leverages the browser-native Web Cryptography API for high performance key generation, meaning you get the same cipher strength as a desktop application or local application without installing any additional software. This is modern JavaScript cryptography running with secure defaults — the openpgp protocol governs the message format, ensuring interoperability across every major email client and protection tool.

Air-gap ready: For the highest possible key protection, consider using the air-gap workflow. Load this page in your local session, then choose to disconnect internet access before filling in the form and clicking generate. Your keys are created with no servers involved — disconnecting removes any theoretical network-layer risk. This is a recommended approach for generating long-lived master private key material. You can also use the command prompt method described below for fully offline key generation.

Your Public Key and Private Key Output Explained

Once you submit the form, the tool produces two distinct blocks of ASCII armored text conforming to the begin pgp key block header standard. Your public component — the one you share freely — looks like this:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGRx...AAAB...
-----END PGP PUBLIC KEY BLOCK-----

Your private key, protected by your chosen passphrase, appears in a separate block:

-----BEGIN PGP PRIVATE KEY BLOCK-----

lQdGBGRx...secret...
-----END PGP PRIVATE KEY BLOCK-----

The ascii armored output format makes both blocks safe to copy and download — use the copy download feature to save them into emails, keyserver upload forms, or a password vault. Never share your private key block with anyone. Store it in an encrypted vault and back it up to offline media. If you use a strong passphrase and maintain solid key protection, even a stolen key file cannot be exploited by an attacker who does not know the passphrase.

The generated keypair also includes automatically created subkeys: one subkey for ciphering (used for message protection and decoding) and one for attesting (used for digital signatures and authentication). This design keeps your master private key isolated — you use the subkeys in day-to-day operations and only expose the primary key for certification events. This is a core key-administration best practice recommended by the openpgp specification and by NIST guidelines.

The following table shows all metadata fields you can read from a newly generated key:

Your Revocation Certificate and Passphrase Protection

Alongside your keypair, the generator produces a revocation certificate — a pre-signed OpenPGP message that lets you publicly invalidate your key if it is ever compromised or if you simply retire it. Store this certificate separately from your private key, ideally on offline media. If your key is lost, the revocation certificate is your only mechanism for signalling to the world that the key should no longer be trusted. Without it, others may continue ciphering messages to a key you can no longer access or control, undermining both adherence to standards and email integrity.

Passphrase protection is enforced for every key this tool generates. When you set a passphrase, the tool uses symmetric ciphering (AES) to protect your private key material before it is displayed. This means even the raw key file sitting on your disk cannot be used without the passphrase. Use a secure passphrase — at minimum 16 characters combining words, numbers, and symbols — and store it in a reputable credential vault. The pgp system provides no built-in way to reset password access; if you forget your passphrase, you must generate a new key, revoke the old one, and notify all correspondents to update their keyrings.

You configure the key expiry through the expiration time field in the generation form. Setting a defined expiration date on your key limits long-term exposure: if your key is ever compromised and you miss it, the key lifetime acts as a natural boundary after which the key stops being trusted. The validity status is embedded directly in the key data and will be visible to anyone who inspects the key. Setting a 1–2 year key expiration date and refreshing on schedule is recommended by infosec professionals for all active pgp key administration.

How to Generate PGP Keys Using the GnuPG Command Line Tool

If you prefer to run pgp key generation at the command prompt on a Linux or POSIX system — or if your organization requires credentials produced by the gpg utility rather than an in-browser generator — GnuPG provides the gold-standard local workflow. The steps below apply to any Debian-derived workstation and cover the full process from initializing the GPG directory through to exporting your key for use in tools like the Mutt mail client.

1. Initialize the GPG directory — install GnuPG:

   sudo apt-get install gnupg

   This installs the gnupg package and prepares the key store (~/.gnupg). On first run, GnuPG creates secring.gpg (your secret ring), pubring.gpg (your public ring), and an options file containing default settings. If this is your first time running gpg, you must run the command once to set up the key store before generation proceeds.

2. Generate a private key with gpg --gen-key or gpg --full-gen-key:

   > gpg --gen-key

   gpg (GnuPG) 1.0.6; Copyright (C) 2001 Free Software Foundation, Inc.
   This program comes with ABSOLUTELY NO WARRANTY.
   This is free software, and you are welcome to redistribute it
   under certain conditions. See the file COPYING for details.
   
   gpg: /home/keymaster/.gnupg/secring.gpg: keyring created
   gpg: /home/keymaster/.gnupg/pubring.gpg: keyring created
   
   Please select what kind of key you want:
      (1) DSA and ElGamal (default)
      (2) DSA (sign only)
      (4) ElGamal (sign and encrypt)
   Your selection? 1
   DSA keypair will have 1024 bits.
   About to generate a new ELG-E keypair.
      minimum keysize is 768 bits
      default keysize is 1024 bits
      highest suggested keysize is 2048 bits
   What keysize do you want? (1024) 4096
   you really need such a large keysize? y
   Requested keysize is 4096 bits

   Use gpg --full-gen-key on modern GnuPG versions for an extended interactive session that exposes additional cipher methods including EdDSA and curve-based exchange. On older versions, gpg --gen-key defaults to DSA and ElGamal with a DSA credential of 1024 bits — always override this to at least 2048 bits, and prefer larger sizes for RSA or Curve25519 for curve-based methods.

3. Choose your cipher method, key size, and key expiry:

   Please specify how long the key should be valid.
            0 = key does not expire
         <n>  = key expires in n days
         <n>w = key expires in n weeks
         <n>m = key expires in n months
         <n>y = key expires in n years
   Key is valid for? (0) 0
   Key does not expire at all
   Is this correct (y/n)? y

   Setting 0 means the credential has no expiry; setting a value such as 2y embeds a hard expiration time in the key. For long-lived infrastructure credentials, a defined key expiration date is recommended. After confirming, GnuPG prompts for your user-id: enter your real name and email address. These values are embedded in the key and will be visible to anyone who inspects it.

4. Enter your passphrase to protect your secret key:

   GnuPG will ask you to enter and repeat a passphrase. This passphrase-protects your private key material stored in the secret ring file. Choose a secure passphrase and record it in a reputable credential manager immediately — there is no mechanism to recover or reset password access to a PGP key.

5. Allow entropy generation to complete:

   GnuPG requires random bytes from the OS random number generator to drive prime generation (for RSA) or scalar multiplication (for curve-based methods). The system will display progress dots and may pause requesting more entropy. Move your mouse, type on the keyboard, or perform disk operations to accelerate the process. Once sufficient random bytes are available, the public and private credentials are created and certified automatically.

   public and secret key created and signed.
   key created and signed.

6. Generate and print a copy of your key ID and fingerprint:

   gpg --fingerprint

   Then export your public component in ASCII armored format for sharing:

   gpg --export -a user-name

   The hash output confirms your identifier and key ID. Share the exported block with correspondents or upload it to a keyserver so others can cipher emails and files to you.

PGP vs RSA Encryption — Key Algorithm Comparison Table

Pretty Good Privacy (PGP) is often confused with RSA because RSA is one of the cipher methods PGP can use internally. Understanding the distinction matters for choosing the right approach and communicating accurately about your cryptographic operations:

In short: PGP vs RSA is not an either/or choice — PGP uses RSA (or curve-based methods) as its underlying cipher for asymmetric operations and certification. The PGP envelope adds message protection, digital attestation, and the fingerprint infrastructure on top.

What Is Elliptic Curve Cryptography — ECC, Ed25519, and ECDH Explained

Elliptic curve cryptography (ECC) is an approach to asymmetric key math grounded in the algebraic structure of curves over finite fields. Unlike RSA — which derives its strength from the difficulty of factoring very large integers — this method relies on the discrete logarithm problem on curves, which is computationally harder to brute-force per bit of key material. The practical consequence is that curve-based methods provide equivalent protection to RSA at dramatically smaller key sizes: a 256-bit Ed25519 credential offers roughly the same cipher strength as a 3072-bit RSA key.

Within the OpenPGP ecosystem, the most widely recommended curve-based options are:

• Curve25519 — used for key agreement (ciphering subkey). Defined in the RFC 6637 extension, widely supported, excellent protection and performance.
• Ed25519 (via EdDSA) — used for the primary attesting key. Produces compact digital signatures with strong resistance to side-channel attacks.
• NIST curves for key agreement — an alternative mechanism for environments requiring FIPS adherence or compatibility with transfer systems that mandate NIST curve support.

The curve-based algorithm family is codified in the OpenPGP specification and is supported by both this in-browser generator (via OpenPGP.js) and the gpg utility on POSIX systems. When you perform pgp key generation using curve methods, the resulting credentials are smaller to store, faster to process, and easier to transmit — making them ideal for high-volume mail protection and file transfer automation. The JavaScript implementation in this tool uses the Web Cryptography API to perform all curve operations directly in your session, ensuring keys never touch a server.

Using PGP Keys with the Mutt Email Client and the Key Size Selection Workflow

For mail users on a POSIX workstation running the Mutt email client, configuring PGP protection requires one additional step beyond key generation. After completing the CLI workflow above, add the following line to your .muttrc configuration file to load the bundled GnuPG helper macros:

source /usr/local/doc/mutt/samples/gpg.rc

This gpg.rc file configures the mail client's key bindings for PGP ciphering, decoding, and digital attestation within the email composition workflow. Each time you send a message, the client will prompt you to attest, cipher, or both — using whichever credential matches your configured email address. The workflow for sending a protected message becomes: compose → press the cipher key binding → the client looks up the recipient's public component in your keyring → message is ciphered and sent. On the receiving side, the decoding step is equally transparent: the client detects the OpenPGP message header and decodes inline.

Key size selection matters particularly for mail workflows where credentials may be in active use for years. A size of larger RSA bits offers strong long-term coverage but takes slightly longer to generate and use on older hardware. If speed is a concern, switching to curve-based methods (Curve25519 / Ed25519) gives you equivalent or better cipher strength with significantly faster operations — an excellent trade-off for mail protection workflows running on low-power hardware or automated pipelines that process files at scale. The input form in this tool exposes the key size choice explicitly, giving you a direct selection between RSA sizes and curve options, so your adherence requirements are met from the moment you click generate.

The questions below reflect the most common concerns from users of any online pgp key pair generator. Transparency about technology and data handling is central to this tool's design, which is why every answer is grounded in the publicly auditable code.

To disconnect internet access before generating: load this page, then take your device offline. The key generation form and all PGP tools continue to function with no additional software needed. This is the recommended workflow for generating master private key material in high-assurance or air-gapped environments where even theoretical exposure to the network must be eliminated. Reconnect only after you have securely saved your key material and revocation certificate. You can also generate credentials via the command prompt using GnuPG as described above.

WebMCP support: WebMCP support — AI agents welcome. This tool supports programmatic access via the WebMCP protocol, meaning an AI agent can invoke the pgp key pair generator directly inside the session to create OpenPGP credentials, analyze existing keys, and provide output as part of an automated workflow step or decoding pipeline. Each workflow step runs entirely in-browser, maintaining the same data handling and confidentiality guarantees that apply to human users. Passphrase and expiration parameters can all be set programmatically, enabling fully automated pgp key generation for DevOps pipelines, transfer integrations, and FIPS adherence validation workflows.

Created by: A publicly auditable team committed to accessible, confidentiality-focused PGP tools. Reviewed by: Independent researchers. The openly licensed foundation this tool rests on — OpenPGP.js, GnuPG, and the broader OpenPGP ecosystem — is freely available online, actively audited, and widely deployed across cybersecurity and digital attestation applications worldwide. Whether you are performing pgp key generation for the first time or verifying an existing credential for adherence purposes, this tool gives you the analysis and generation capabilities to maintain strong mail protection, file integrity, and confidential communication — entirely within your session, entirely under your control.

References:

• RFC 4880 — OpenPGP Message Format
• RFC 6637 — Elliptic Curve Cryptography in OpenPGP
• GnuPG Official Documentation
• OpenPGP.js Library