PGP Encryption and Decryption Online

PGP encryption online, without sending your keys anywhere

This PGP encryption tool does the four everyday OpenPGP jobs in your browser: encrypt a message or file to someone’s public key, decrypt what was sent to you, sign text so others can prove it came from you, and verify a signature. It also generates a PGP key pair when you need one.

It uses OpenPGP.js, the open-source library behind several encrypted-mail services, and produces standard ASCII-armored output that GnuPG, Kleopatra, Thunderbird and other OpenPGP software read. The library is loaded the first time you press a button; after that the page makes no network requests, and your private key, passphrase and messages are never uploaded or saved.

How to use the PGP Encrypt & Decrypt

1. No keys yet? Open Generate keys, enter a name or email and a passphrase, and press Generate key pair. Download both keys and the revocation certificate, and share only the public key.
2. To encrypt, paste the recipient’s public key and your message (or choose File), then press Encrypt message. Add your private key and passphrase if you want to sign it too.
3. To decrypt, paste the PGP message, your private key and its passphrase. Add the sender’s public key to check their signature.
4. To sign or verify, paste the text and your private key — or the signed text and the signer’s public key.
5. Copy the result or download it as an .asc file. Clear keys and text wipes everything from the page.

PGP Encrypt & Decrypt features

How PGP encryption and decryption work

PGP uses a key pair. The public key can be shared with anyone: it is used to encrypt messages to you and to check your signatures. The private key, protected by your passphrase, is the only thing that can decrypt those messages and create your signatures. When you encrypt, the software creates a one-time random session key, encrypts the message with it using AES, and then encrypts that session key to each recipient’s public key. Decryption reverses this with the private key, and an integrity check rejects any message that was changed on the way.

A signature is a hash of the text signed with the private key. Verifying it with the public key proves who signed it and that not a single character has changed — the tool shows “Good signature” or “Bad signature” with the key ID.

Keeping your private key safe

• Always set a passphrase when you generate a key, and keep a backup of the private key file somewhere offline.
• Never paste your private key into a page you do not trust. This tool works offline once loaded — you can disconnect before decrypting to check that nothing is sent.
• Compare the fingerprint with the other person by phone or in person before trusting a public key someone emailed you.
• Keep the revocation certificate: if the private key is lost or stolen, publishing it tells others to stop using the key.
• For passwords, use the passphrase generator.

PGP or a password?

PGP is best when you exchange messages with the same people repeatedly or need signatures. For a one-off secret with a friend who has no PGP software, the password mode here, or the simpler AES-256 text encryption tool, is easier — just send the password by a different channel. To check a downloaded file against a published checksum rather than a signature, use the file hash checker.

Limits: keys are not uploaded to or fetched from key servers, smart cards and hardware keys are not supported, and very large files are processed in memory (up to 100 MB). OpenPGP.js is LGPL-3.0 software and is loaded unmodified from jsDelivr.