Introduction
PGP keys let you sign and encrypt messages, files, and software releases using a web-of-trust model that predates modern TLS. Phil Zimmermann created PGP in 1991 as a grassroots encryption tool, and it remains the standard for email security, software signing, and verified communication. A pgp key generator creates the public and private key pair you need to participate. This tool uses OpenPGP.js (v6.3.1) to generate ECC and RSA key pairs entirely in your browser. No key material leaves your device. Pick a key type, enter your name and email for the user ID, optionally set a passphrase and expiration, and click generate. You get an armored public key to share, an armored private key to protect, and a revocation certificate for emergencies. ECC on Curve25519 is the modern default. RSA 4096 provides compatibility with older OpenPGP implementations.
What this tool does
- Generates OpenPGP key pairs using OpenPGP.js v6.3.1, compliant with RFC 9580.
- Supports ECC keys on Curve25519 (recommended) and RSA keys at 2048 or 4096 bits.
- Creates ASCII-armored public and private keys in standard OpenPGP format with BEGIN/END PGP markers.
- Generates a revocation certificate for revoking the key if it is compromised or lost.
- Binds a user ID (name and email) to the key, following the OpenPGP identity model.
- Optionally encrypts the private key with a passphrase using string-to-key protection.
- Supports configurable expiration: never, 1 year, 2 years, or 5 years.
How this tool works
This tool calls OpenPGP.js's generateKey function with your selected parameters. For ECC keys, it requests a Curve25519 key pair, which uses EdDSA for signing and ECDH for encryption. For RSA keys, it generates an RSA key pair at the selected bit size. The function accepts a user ID (name and email), an optional passphrase for private key protection, and a key expiration time in seconds.
The output is ASCII-armored. The public key and private key are returned as text blocks wrapped in BEGIN/END PGP PUBLIC KEY BLOCK and BEGIN/END PGP PRIVATE KEY BLOCK markers. The revocation certificate is a separate armored block that you publish if the key is ever compromised. All key generation happens client-side in your browser's JavaScript runtime. Your passphrase, name, email, and private key never leave your device. The generated keys are compatible with GnuPG, Mailvelope, Sequoia, and other OpenPGP software that supports RFC 9580.
How OpenPGP keys work
OpenPGP is the IETF-standardized successor to Zimmermann's original PGP. The current standard is RFC 9580, published in 2024, which supersedes RFC 4880 from 2007. Phil Zimmermann created PGP in 1991 as a tool for grassroots encryption. You can read more about its history on Wikipedia.
An OpenPGP key pair consists of a primary key and optional subkeys. The primary key carries the user ID (name and email) and is used for signing. Subkeys handle encryption and may use different algorithms or expiration dates. This tool generates a primary signing key and an encryption subkey in a single operation.
The key format supports multiple algorithms. RSA (defined in RFC 8017) is the legacy option, widely supported but slow. EdDSA on Ed25519 handles signing for ECC keys, and ECDH on Curve25519 handles encryption. These elliptic-curve algorithms produce smaller keys (256 bits) and operate faster than RSA at equivalent security levels.
The web of trust model lets users sign each other's keys to build a decentralized trust graph, unlike X.509 certificates which rely on centralized certificate authorities. Key servers like keys.openpgp.org distribute public keys so others can find and verify them. The revocation certificate is generated at key creation time and cannot be regenerated without the private key. If you lose your private key or it is compromised, you publish the revocation certificate to notify others that the key is no longer valid.
How to use this tool
- Enter your name and email. These form the user ID bound to the key. At least one is required.
- Select a key type: ECC (Curve25519, recommended) or RSA (2048 or 4096 bits).
- Optionally enter a passphrase to encrypt the private key at rest. You will need it every time you use the key.
- Choose an expiration: never, 1 year, 2 years, or 5 years. Shorter expirations limit damage from compromised keys.
- Click Generate. Key generation happens in your browser and may take a few seconds for RSA 4096.
- Copy the public key and share it via a key server, email signature, or direct distribution to contacts.
- Save the private key securely. Store the revocation certificate separately in case you need to revoke the key later.
Real-world examples
Signing software releases
A maintainer of an open-source Python package wants to sign release artifacts so users can verify they came from her. She generates an ECC key pair with the user ID "Jane Doe
Encrypted email communication
A journalist needs a secure channel for a source to send documents. She generates an RSA 4096-bit key pair, exports the public key as an armored block, and sends it to the source via Signal. The source imports it into Mailvelope (a browser extension for OpenPGP) and uses it to encrypt an email containing the documents. Only the journalist's private key can decrypt the message. She stores the revocation certificate on a USB drive in a safe deposit box, separate from her laptop where the private key lives.
Revoking a compromised key
A developer's laptop is stolen, and his PGP private key was stored on it. He retrieves the revocation certificate he had printed and stored in a desk drawer, imports it into GnuPG with gpg --import revocation.asc, and sends the revoked key to keys.openpgp.org with gpg --keyserver keys.openpgp.org --send-keys
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| ECC (Curve25519) | Low (256-bit key, fast signing and encryption) | New OpenPGP keys for GnuPG 2.1+ and modern clients |
| RSA 2048 | Medium (256-byte key, 112-bit security level) | Compatibility with older OpenPGP implementations |
| RSA 4096 | High (512-byte key, 150-bit security, slow generation) | Maximum RSA security for long-term keys |
Limitations or considerations
This tool generates keys in your browser and does not upload them to a key server. You must distribute your public key manually or upload it to keys.openpgp.org. The tool does not support adding subkeys, photo IDs, or additional user IDs after generation. For those operations, use GnuPG's gpg --edit-key command. RSA 4096 key generation can take several seconds. The revocation certificate is generated at key creation time and cannot be regenerated without the private key. Store it somewhere safe and separate from your private key. This tool does not support hardware token (smartcard) key generation.
Frequently asked questions
Is it safe to generate PGP keys in a browser?
Yes. This tool uses OpenPGP.js, which runs entirely in your browser. Your name, email, passphrase, and private key are never transmitted to a server. The randomness comes from your browser's cryptographically secure random number generator, which draws from the operating system's entropy source.
What is a revocation certificate and why do I need it?
It is a signed statement that marks your key as no longer valid. You publish it to a key server if your private key is compromised, lost, or retired. It is generated at key creation time because it requires the private key to sign. If you lose your private key and do not have the revocation certificate, you cannot revoke the key, and others may continue trusting it.
Should I choose ECC or RSA for my PGP key?
ECC on Curve25519 for new keys. It produces 256-bit keys that are smaller and faster than RSA at equivalent security. Use RSA only when you need compatibility with older OpenPGP software that lacks ECC support. RSA 2048 is the minimum for new RSA keys. RSA 4096 provides a 150-bit security level.
Should I set an expiration date on my key?
Yes, for most users. A 2-year expiration forces you to rotate keys periodically. If you lose your private key and forget to revoke it, the key automatically expires. You can always extend the expiration later with gpg --edit-key if you still have the private key. Use "never" only for long-term identity keys that you protect carefully.
Can I import these keys into GnuPG?
Yes. Save the armored private key to a file and run gpg --import private.key. The public key can be imported the same way. If you set a passphrase, GnuPG will prompt for it when you use the key. The keys are compatible with GnuPG 2.1 and later, Mailvelope, Sequoia, and other software supporting RFC 9580.
Conclusion
Use this pgp key generator when you need OpenPGP keys for email encryption, software signing, or verified communication. ECC on Curve25519 is the right default for new keys. RSA 4096 works when you need compatibility with older OpenPGP implementations. Always protect your private key with a strong passphrase, and store your revocation certificate somewhere safe and separate from your key. If you lose access to your private key without a revocation certificate, others have no way to know the key is no longer valid.