Introduction
Pretty Good Privacy (PGP) has protected email, source code, and sensitive files since Phil Zimmermann released it in 1991. Today the OpenPGP standard, formalized in RFC 9580, defines how asymmetric keys and symmetric ciphers combine to encrypt data end-to-end. Developers use PGP to sign software releases, journalists secure tip lines, and sysadmins encrypt configuration backups. This pgp encrypt decrypt online tool runs the OpenPGP.js v6 library entirely in your browser, so your plaintext, private keys, and passphrases never touch a server. Paste a recipient's public key, type your message, and produce an armored PGP block you can send over any channel.
What this tool does
- Encrypts plaintext into an ASCII-armored PGP message using the recipient's public key (OpenPGP.js v6, RFC 9580).
- Optionally signs the encrypted message with your private key so the recipient can verify sender authenticity.
- Decrypts armored PGP messages using your private key, with passphrase support for protected keys.
- Handles hybrid encryption automatically: a random session key is encrypted with the public key, then the message is encrypted with a symmetric cipher.
- Keeps every operation client-side. No keys, messages, or passphrases are transmitted or stored.
- Outputs standard armored blocks (-----BEGIN PGP MESSAGE-----) compatible with GnuPG, Gpg4win, and other OpenPGP implementations.
How this tool works
The tool uses OpenPGP.js v6, a JavaScript implementation of the OpenPGP standard. On the Encrypt tab you paste the recipient's armored public key and your plaintext. The library parses the public key, generates a random symmetric session key, encrypts your message with that session key using a symmetric cipher, then encrypts the session key with the recipient's public key. The output is an ASCII-armored block you can paste into email or chat. If you provide a signing private key and passphrase, the library signs the message before encryption so the recipient can confirm it came from you. On the Decrypt tab you paste the armored message and your private key. If the key is passphrase-protected, the library decrypts the key first, then uses it to recover the session key and decrypt the message. All of this runs in your browser via WebAssembly and JavaScript. Nothing is sent over the network, which matters when you are handling private keys on a machine you do not fully control.
How PGP encryption works
PGP uses hybrid encryption because pure asymmetric encryption is slow and limited in message size. When you encrypt a message, PGP generates a random session key and encrypts your data with a symmetric cipher (AES). It then encrypts that session key with the recipient's RSA or elliptic-curve public key. The recipient uses their private key to decrypt the session key, then uses the session key to decrypt the actual message. This combines the speed of symmetric ciphers with the key-distribution benefits of asymmetric cryptography. Phil Zimmermann created PGP in 1991, and it became the basis for the OpenPGP standard, most recently updated in RFC 9580. The standard supports multiple symmetric algorithms (AES-128, AES-256, Camellia), hash functions (SHA-256, SHA-512), and asymmetric algorithms (RSA, EdDSA, ECDH). Signed encryption adds a digital signature over the plaintext, letting the recipient verify the sender using the sender's public key. This non-repudiation property is why PGP is used to sign Git commits, software releases (Debian packages, npm tarballs), and security advisories.
How to use this tool
- Switch to the Encrypt tab and paste your plaintext message into the input field.
- Paste the recipient's armored public key (the block starting with -----BEGIN PGP PUBLIC KEY BLOCK-----).
- Optional: paste your own private key and passphrase to sign the message so the recipient can verify you sent it.
- Click Encrypt message. The tool produces an armored PGP block. Copy it and send it through any channel.
- To decrypt, switch to the Decrypt tab and paste the armored PGP message you received.
- Paste your private key and enter its passphrase if the key is protected. Click Decrypt message to reveal the plaintext.
Real-world examples
Encrypting a sensitive email to a journalist
A whistleblower wants to send documents to a journalist at a news outlet. The journalist publishes their PGP public key on their website (a block starting with -----BEGIN PGP PUBLIC KEY BLOCK-----). The whistleblower pastes that public key and their message into this tool, clicks Encrypt, and gets an armored block. They paste that block into a regular email. Even if the email is intercepted, only the journalist's private key can decrypt it. The whistleblower also adds their own signing key so the journalist can verify the message was not spoofed.
Verifying a signed software release
A Linux distribution maintainer signs release tarballs with their PGP private key and distributes the signature alongside the download. A user receives the detached signature and the maintainer's public key from a trusted keyserver. The user can use the Decrypt tab to process the signed message and confirm the signature matches the maintainer's key. This is the same mechanism Debian uses for apt package verification and how npm verifies signed tarballs. If the signature check fails, the user knows the file was tampered with or came from a different key.
Decrypting a backup encrypted with a colleague's key
Two sysadmins share encrypted configuration backups. Admin A encrypts a backup using Admin B's public key and stores the armored block in a shared drive. When Admin B needs to restore, they paste the encrypted block into the Decrypt tab, provide their private key and passphrase, and recover the plaintext configuration. Because the key never left Admin B's machine and the passphrase was never transmitted, the backup stays confidential even if the shared drive is compromised.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| PGP (OpenPGP) | High | End-to-end encrypted email, signed software releases, file encryption |
| S/MIME | Medium | Enterprise email encryption using X.509 certificates and a CA hierarchy |
| Symmetric AES (password-based) | Low | Single-key file encryption where both parties share a password |
| TLS in transit | Medium | Encrypts data between endpoints but not at rest on servers |
Limitations or considerations
PGP does not encrypt the metadata of your communication. The subject line, sender, recipient, and timestamps of an email remain visible, which is why PGP is often called encryption for content, not for traffic analysis. Key management is the hardest part: if you lose your private key, encrypted messages are permanently unrecoverable, and if your private key is compromised, all messages encrypted to it are exposed. This tool runs in your browser, so a compromised machine with a keylogger can capture your passphrase. For high-stakes use, keep your private key on an offline machine or a hardware token. PGP also does not provide forward secrecy, unlike Signal or TLS 1.3, meaning a single key compromise retroactively exposes past messages.
Frequently asked questions
Is my private key safe when I use this tool?
The key stays in your browser memory and is never sent to a server. However, a compromised browser extension or keylogger on your machine can still capture it. Use a clean machine for high-value keys.
What is the difference between PGP and OpenPGP?
PGP is the original software Phil Zimmermann wrote in 1991. OpenPGP is the IETF standard (RFC 9580) derived from it. OpenPGP.js, GnuPG, and Gpg4win all implement the OpenPGP standard.
Can the recipient decrypt my message without this tool?
Yes. The output is a standard armored OpenPGP message. The recipient can use GnuPG (gpg -d), Gpg4win, Mailvelope, or any RFC 9580-compatible client to decrypt it with their private key.
Why does PGP use hybrid encryption instead of just RSA?
RSA is slow and can only encrypt small payloads. PGP generates a fast symmetric session key for the message, then encrypts that session key with RSA. This scales to large files while keeping the asymmetric key-distribution benefits.
What happens if I lose my private key or passphrase?
The messages are unrecoverable. There is no backdoor in OpenPGP. This is why you should back up your private key and passphrase in a secure location like a password manager or offline storage.
Conclusion
This pgp encrypt decrypt online tool gives you a browser-based way to encrypt and decrypt OpenPGP messages without installing GnuPG or exposing your keys to a server. It follows RFC 9580 and uses OpenPGP.js v6 for hybrid encryption with optional signing. Use it for email, file encryption, and verifying signed software. Keep your private key offline and passphrase-protected, and remember that PGP protects content but not metadata. Paste your keys and message above to get started.