PGP Key Pair Generator

Keeping your communications truly private starts with a single decision: generating a trustworthy PGP key pair. This pgp key pair generator gives you full control over your encryption and digital-signing credentials — producing an OpenPGP-compliant keypair directly inside your local session, with passphrase protection built in from the first keystroke. Whether you need to encrypt emails, secure file transfers, or establish authenticated workflows in a DevOps pipeline, understanding what your generated keys contain — and how to inspect, distribute, and protect them — is the foundation of sound cybersecurity practice.

Generate a real PGP key pair with the PGP Key Pair Generator by entering your name and email, picking a key type — RSA or the faster ECC (Curve25519) — and optionally setting a passphrase to protect the private key, then you get a matching public key and private key in standard OpenPGP format. It's powered by the OpenPGP.js library and runs fully in your browser, so your private key material is generated and stays on your own device.

Your Secure PGP Key Generator — Instant, Private, and Air-Gap Ready

This secure pgp key generator runs entirely in-browser with no data sent to any backend server, no keys transmitted over the network, and no session details written to a log file. The privacy & security notice is simple: your keys are generated locally, they never leave your device, they are never uploaded, never stored, and never logged. The only analytics touchpoint on this site is Google Analytics, used purely for aggregate visitor counts — no user tracking of key-related data takes place whatsoever. With no servers involved in the key generation process, your credentials remain entirely under your control.

The tool is powered by OpenPGP.js, an actively maintained, publicly auditable JavaScript implementation of the OpenPGP standard (defined in RFC 4880 and extended by RFC 6637). It leverages the browser-native Web Cryptography API for high performance key generation, meaning you get the same cipher strength as a desktop application or local application without installing any additional software. This is modern JavaScript cryptography running with secure defaults — the openpgp protocol governs the message format, ensuring interoperability across every major email client and protection tool.

Air-gap ready: For the highest possible key protection, consider using the air-gap workflow. Load this page in your local session, then choose to disconnect internet access before filling in the form and clicking generate. Your keys are created with no servers involved — disconnecting removes any theoretical network-layer risk. This is a recommended approach for generating long-lived master private key material. You can also use the command prompt method described below for fully offline key generation.

Your Public Key and Private Key Output Explained

Once you submit the form, the tool produces two distinct blocks of ASCII armored text conforming to the begin pgp key block header standard. Your public component — the one you share freely — looks like this:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGRx...AAAB...
-----END PGP PUBLIC KEY BLOCK-----

Your private key, protected by your chosen passphrase, appears in a separate block:

-----BEGIN PGP PRIVATE KEY BLOCK-----

lQdGBGRx...secret...
-----END PGP PRIVATE KEY BLOCK-----

The ascii armored output format makes both blocks safe to copy and download — use the copy download feature to save them into emails, keyserver upload forms, or a password vault. Never share your private key block with anyone. Store it in an encrypted vault and back it up to offline media. If you use a strong passphrase and maintain solid key protection, even a stolen key file cannot be exploited by an attacker who does not know the passphrase.

The generated keypair also includes automatically created subkeys: one subkey for ciphering (used for message protection and decoding) and one for attesting (used for digital signatures and authentication). This design keeps your master private key isolated — you use the subkeys in day-to-day operations and only expose the primary key for certification events. This is a core key-administration best practice recommended by the openpgp specification and by NIST guidelines.

The following table shows all metadata fields you can read from a newly generated key:

Passphrase Protection — and What This Tool Doesn't Generate

The Private Key Passphrase field on this page is optional, not enforced — leave it blank and your private key block is produced unprotected; set a passphrase and the tool uses it to symmetrically encrypt (AES) the private key material before displaying it, so the raw key text alone isn't usable without also knowing the passphrase. There's no built-in way to recover a forgotten passphrase: if you lose it, you'd need to generate a new key pair and, once you're able to reach the old one again, revoke it.

This tool does not produce a separate revocation certificate or offer a key-expiry field — you get exactly the two output blocks shown above (public and private key), generated with no expiration date set. If your workflow needs a revocation certificate or an expiring key, generate one with a full OpenPGP program such as GnuPG (see the command-line section below), which supports both.

RSA vs ECC (Curve25519): Choosing a Key Type When You Generate

Why This Tool Defaults to Curve25519

This generator gives you exactly one decision that meaningfully affects your key's shape: RSA or ECC (Curve25519). There is no key-inspection or key-analysis feature on this page -- it only ever produces new keys -- so getting this choice right up front, before you generate and start using a key, matters more here than it would in a tool that lets you re-examine a key afterward. Paste your value into the base64 encoder decoder to see the converted result appear immediately.

RSA is the older, more universally supported option. This tool offers 2048-bit and 4096-bit RSA -- 4096-bit is the default and the safer long-term choice, since 2048-bit RSA is adequate today but has a shorter comfortable margin against future advances in factoring. RSA keys are also larger: a 4096-bit RSA public key is several times the size of a Curve25519 key in its armored text form, and RSA key generation itself is noticeably slower in the browser, especially at 4096 bits. Choose RSA when you specifically need compatibility with an older mail client, a corporate PGP gateway, or a hardware token that has not added Curve25519 support.

Curve25519 -- this tool's default -- uses a completely different kind of math (elliptic-curve, not integer factoring) to reach an equivalent or stronger security level at a fraction of the key size: a 256-bit Curve25519 key is roughly comparable in strength to a 3072-bit RSA key. It generates almost instantly in the browser, produces a much shorter armored key block, and is supported by every actively maintained OpenPGP implementation released in the last several years, including GnuPG and every desktop and mobile app built on it. Unless you have a specific compatibility reason to pick RSA, Curve25519 is the better default for a new key today.

Importing Your Generated Key Into a Real PGP Program

Generating a key here is only the first step -- to actually use it for encrypting mail or signing files, you need to import it into a real OpenPGP program. Because this tool produces standard, ASCII-armored OpenPGP output (the same -----BEGIN PGP PUBLIC KEY BLOCK----- / -----BEGIN PGP PRIVATE KEY BLOCK----- format every OpenPGP tool reads and writes), that import step works the same way it would for a key generated anywhere else:

• GnuPG (command line): save the copied private key block to a file (e.g. my-key.asc) and run gpg --import my-key.asc. GnuPG will report the key ID it imported and add it to your local keyring; run gpg --list-secret-keys to confirm it is there.
• GPG Suite (macOS): open GPG Keychain, choose File > Import, and select the saved .asc file (or simply paste the key text -- GPG Keychain also accepts a paste-to-import).
• Kleopatra (Windows/Linux, part of Gpg4win): choose File > Import, point it at your saved key file, and Kleopatra will add both the public and private key to its certificate list.
• Mail clients with built-in OpenPGP support (Thunderbird, ProtonMail, and others): most modern mail clients that support OpenPGP natively include their own "import an existing key" option in their account security settings, which accepts the same armored text.

Whichever program you import into, keep the private key block exactly as generated -- do not edit its text -- and store the file somewhere you control rather than leaving it in your Downloads folder indefinitely. If you set a passphrase when generating, the importing program will ask for it the first time you try to sign or decrypt with the key.

How to Generate PGP Keys Using the GnuPG Command Line Tool

If you prefer to run pgp key generation at the command prompt on a Linux or POSIX system — or if your organization requires credentials produced by the gpg utility rather than an in-browser generator — GnuPG provides the gold-standard local workflow. The steps below apply to any Debian-derived workstation and cover the full process from initializing the GPG directory through to exporting your key for use in tools like the Mutt mail client. Use the free file encrypter decrypter to switch formats in one click — no install or account needed.

1. Initialize the GPG directory — install GnuPG:

   sudo apt-get install gnupg

   This installs the gnupg package and prepares the key store (~/.gnupg). On first run, GnuPG creates secring.gpg (your secret ring), pubring.gpg (your public ring), and an options file containing default settings. If this is your first time running gpg, you must run the command once to set up the key store before generation proceeds.

2. Generate a private key with gpg --gen-key or gpg --full-gen-key:

   > gpg --gen-key

   gpg (GnuPG) 1.0.6; Copyright (C) 2001 Free Software Foundation, Inc.
   This program comes with ABSOLUTELY NO WARRANTY.
   This is free software, and you are welcome to redistribute it
   under certain conditions. See the file COPYING for details.
   
   gpg: /home/keymaster/.gnupg/secring.gpg: keyring created
   gpg: /home/keymaster/.gnupg/pubring.gpg: keyring created
   
   Please select what kind of key you want:
      (1) DSA and ElGamal (default)
      (2) DSA (sign only)
      (4) ElGamal (sign and encrypt)
   Your selection? 1
   DSA keypair will have 1024 bits.
   About to generate a new ELG-E keypair.
      minimum keysize is 768 bits
      default keysize is 1024 bits
      highest suggested keysize is 2048 bits
   What keysize do you want? (1024) 4096
   you really need such a large keysize? y
   Requested keysize is 4096 bits

   Use gpg --full-gen-key on modern GnuPG versions for an extended interactive session that exposes additional cipher methods including EdDSA and curve-based exchange. On older versions, gpg --gen-key defaults to DSA and ElGamal with a DSA credential of 1024 bits — always override this to at least 2048 bits, and prefer larger sizes for RSA or Curve25519 for curve-based methods.

3. Choose your cipher method, key size, and key expiry:

   Please specify how long the key should be valid.
            0 = key does not expire
         <n>  = key expires in n days
         <n>w = key expires in n weeks
         <n>m = key expires in n months
         <n>y = key expires in n years
   Key is valid for? (0) 0
   Key does not expire at all
   Is this correct (y/n)? y

   Setting 0 means the credential has no expiry; setting a value such as 2y embeds a hard expiration time in the key. For long-lived infrastructure credentials, a defined key expiration date is recommended. After confirming, GnuPG prompts for your user-id: enter your real name and email address. These values are embedded in the key and will be visible to anyone who inspects it.

4. Enter your passphrase to protect your secret key:

   GnuPG will ask you to enter and repeat a passphrase. This passphrase-protects your private key material stored in the secret ring file. Choose a secure passphrase and record it in a reputable credential manager immediately — there is no mechanism to recover or reset password access to a PGP key.

5. Allow entropy generation to complete:

   GnuPG requires random bytes from the OS random number generator to drive prime generation (for RSA) or scalar multiplication (for curve-based methods). The system will display progress dots and may pause requesting more entropy. Move your mouse, type on the keyboard, or perform disk operations to accelerate the process. Once sufficient random bytes are available, the public and private credentials are created and certified automatically.

   public and secret key created and signed.
   key created and signed.

6. Generate and print a copy of your key ID and fingerprint:

   gpg --fingerprint

   Then export your public component in ASCII armored format for sharing:

   gpg --export -a user-name

   The hash output confirms your identifier and key ID. Share the exported block with correspondents or upload it to a keyserver so others can cipher emails and files to you.

PGP vs RSA Encryption — Key Algorithm Comparison Table

Pretty Good Privacy (PGP) is often confused with RSA because RSA is one of the cipher methods PGP can use internally. Understanding the distinction matters for choosing the right approach and communicating accurately about your cryptographic operations:

In short: PGP vs RSA is not an either/or choice — PGP uses RSA (or curve-based methods) as its underlying cipher for asymmetric operations and certification. The PGP envelope adds message protection, digital attestation, and the fingerprint infrastructure on top.

What Is Elliptic Curve Cryptography — ECC, Ed25519, and ECDH Explained

Elliptic curve cryptography (ECC) is an approach to asymmetric key math grounded in the algebraic structure of curves over finite fields. Unlike RSA — which derives its strength from the difficulty of factoring very large integers — this method relies on the discrete logarithm problem on curves, which is computationally harder to brute-force per bit of key material. The practical consequence is that curve-based methods provide equivalent protection to RSA at dramatically smaller key sizes: a 256-bit Ed25519 credential offers roughly the same cipher strength as a 3072-bit RSA key.

Within the OpenPGP ecosystem, the most widely recommended curve-based options are:

• Curve25519 — used for key agreement (ciphering subkey). Defined in the RFC 6637 extension, widely supported, excellent protection and performance.
• Ed25519 (via EdDSA) — used for the primary attesting key. Produces compact digital signatures with strong resistance to side-channel attacks.
• NIST curves for key agreement — an alternative mechanism for environments requiring FIPS adherence or compatibility with transfer systems that mandate NIST curve support.

The curve-based algorithm family is codified in the OpenPGP specification and is supported by both this in-browser generator (via OpenPGP.js) and the gpg utility on POSIX systems. When you perform pgp key generation using curve methods, the resulting credentials are smaller to store, faster to process, and easier to transmit — making them ideal for high-volume mail protection and file transfer automation. The JavaScript implementation in this tool uses the Web Cryptography API to perform all curve operations directly in your session, ensuring keys never touch a server.

Verifying Your Key After You Import It

Confirming the Import Worked

After importing your generated private key into GnuPG, Kleopatra, GPG Suite, or your mail client's own key manager, it is worth confirming the import produced exactly the key you expect before you start relying on it. From the command line with GnuPG, gpg --list-secret-keys lists every private key in your keyring, including the name, email, and comment you entered on this page's form and the key ID GnuPG assigned it. Running gpg --fingerprint <key-id-or-email> prints the full fingerprint for that key -- worth saving alongside the key itself, since it is the value people you correspond with will use to confirm out-of-band that they have the right public key for you.

Setting Up Mail Encryption Comes After Import, Not Here

This page only generates the key pair -- it does not configure any mail client or messaging app to use it. Once your key is imported into GnuPG, Kleopatra, or GPG Suite, the next step happens inside whichever mail client you use: Thunderbird's built-in OpenPGP support or GPG Suite's integration with Apple Mail will each pick up an imported key from the same underlying keyring and let you select it in that account's encryption settings. If your mail provider offers PGP support directly, as several webmail providers now do, look for an "import an existing key" option there instead, and paste in the armored private key block from this page.

The questions below reflect the most common concerns from users of any online pgp key pair generator. Transparency about technology and data handling is central to this tool's design, which is why every answer is grounded in the publicly auditable code.

To disconnect internet access before generating: load this page, then take your device offline. The key generation form and all PGP tools continue to function with no additional software needed. This is the recommended workflow for generating master private key material in high-assurance or air-gapped environments where even theoretical exposure to the network must be eliminated. Reconnect only after you have securely saved your key material and revocation certificate. You can also generate credentials via the command prompt using GnuPG as described above.

The openly licensed foundation this tool rests on — OpenPGP.js, GnuPG, and the broader OpenPGP ecosystem — is freely available online, actively audited, and widely deployed across cybersecurity and digital attestation applications worldwide. Whether you are performing pgp key generation for the first time or verifying an existing credential for adherence purposes, this tool gives you the analysis and generation capabilities to maintain strong mail protection, file integrity, and confidential communication — entirely within your session, entirely under your control.

References:

• RFC 4880 — OpenPGP Message Format
• RFC 6637 — Elliptic Curve Cryptography in OpenPGP
• GnuPG Official Documentation
• OpenPGP.js Library

Frequently Asked Questions

Is this real PGP, or a simplified version?

It's real OpenPGP -- generated using OpenPGP.js, a widely used, standards-compliant implementation of the OpenPGP standard (RFC 4880). The resulting keys work with GnuPG, Thunderbird/Enigmail, Proton Mail's PGP import, and any other OpenPGP-compatible software.

RSA or ECC (Curve25519) -- which should I choose?

Curve25519 (ECC) is the modern default: smaller keys, faster operations, and equivalent or stronger security than 4096-bit RSA. Choose RSA only if you specifically need compatibility with older software or a service that hasn't added Curve25519 support yet.

Do I need to set a passphrase?

Strongly recommended. The passphrase encrypts your private key at rest -- without one, anyone who gets a copy of the private key file can use it immediately. With a passphrase, they'd also need to crack that passphrase first.

Is my key pair sent to a server?

No. Key generation happens entirely in your browser using the Web Crypto APIs underlying OpenPGP.js -- neither your name/email, your generated keys, nor your passphrase are ever transmitted anywhere.

What do I do with the two keys after generating them?

Share the Public Key freely -- post it, email it, upload it to a keyserver -- so others can encrypt messages to you or verify your signatures. Keep the Private Key secret and back it up somewhere safe; it's what lets you decrypt messages and create signatures, and it cannot be regenerated if lost.