Shiklo Tools
PDF40
Image20
Calculators & Converters25
Text & Writing13
Developer26
Video14
Audio14
Document14
Data & Spreadsheet12
Web & SEO9
OCR & Scanning5
Archive & File12
Security & Privacy23
Health & Medical29
QR & Barcode5

PGP Key Generator

Create an OpenPGP key pair (ECC Curve25519 or RSA 4096) with a passphrase, expiry and revocation certificate — for email and file encryption.

OpenPGP keys let people send you encrypted email and files that only you can read, and let you sign messages and software so others can check they really came from you. Journalists, security teams, open-source maintainers and anyone with a security.txt file use them. Creating one normally means installing GnuPG and working on the command line.

This generator creates a complete OpenPGP key pair in your browser with OpenPGP.js: enter your name and email, choose a modern ECC Curve25519 key or a classic RSA 4096 key, set an expiry date and a strong passphrase, and press Generate. You get your public key to share, your private key protected by the passphrase, and a revocation certificate to cancel the key if it is ever lost or stolen — all as standard ASCII-armored files that GnuPG, Kleopatra, Thunderbird, Proton Mail, Mailvelope and other OpenPGP apps import.

How to use PGP Key Generator

  1. Enter your name and email address.
  2. Choose a passphrase of at least 12 characters and type it twice.
  3. Choose the key type and when it should expire.
  4. Press Generate keys and download the public key, private key and revocation certificate.

Features

  • ECC Curve25519 (recommended) or RSA 4096 keys.
  • Private key protected by your passphrase.
  • Expiry after 1, 2 or 5 years, or never.
  • Revocation certificate included.
  • ASCII-armored .asc files for any OpenPGP app.
  • Key fingerprint shown.
  • OpenPGP.js in your browser; nothing is sent.

The three files

A key pair comes with three pieces, each with a different purpose. Download all three and keep the private ones safe.

FileWhat it is forShare it?
Public keyOthers encrypt to you and check your signaturesYes — publish it
Private keyYou decrypt and sign; protected by your passphraseNever
Revocation certificateCancels the key if it is lost or stolenOnly when revoking

ECC or RSA?

Curve25519 keys (Ed25519 for signing and X25519 for encryption) are the modern default in GnuPG: small, fast and strong. RSA 4096 keys are larger and slower to generate but work with very old software. Unless you need compatibility with an old system, choose ECC. Generating an RSA 4096 key in the browser can take several seconds.

Expiry and passphrase

An expiry date is a safety net: if you lose access to the key, it stops being used automatically. You can extend the expiry later with your OpenPGP app as long as you have the private key, so a two-year expiry is a common choice. The passphrase encrypts the private key, so a stolen copy is useless without it; use at least 12 characters, ideally a passphrase of several random words, and keep it in a password manager.

Using your keys

Import the private key into your OpenPGP app — GnuPG with gpg --import, Kleopatra, Thunderbird's OpenPGP settings, or Mailvelope. Share the public key by email, on your website, in your security.txt file, or on a key server such as keys.openpgp.org, and tell people your fingerprint through a separate channel so they can check they have the right key. Store the revocation certificate offline, for example printed or on a USB stick.

Private

Keys are generated on your device by OpenPGP.js, an open-source library maintained by Proton and audited independently, used here unmodified under its LGPL licence. Nothing — not your passphrase, not your keys — is sent anywhere or stored after you leave the page. For a security.txt file that lists your key, use the security.txt Generator.

Frequently asked questions

What is a key fingerprint?

A short code that identifies your key; others compare it to make sure they have the right public key.

How do I create a PGP key?

Enter your name, email and passphrase, choose the key type and press Generate keys.

Should I choose ECC or RSA?

ECC Curve25519, unless you need compatibility with very old software.

Can I use the key with GnuPG or Thunderbird?

Yes. The .asc files import into GnuPG, Kleopatra, Thunderbird and other OpenPGP apps.

What is the revocation certificate for?

It cancels your key if the private key is lost or stolen. Keep it safe and offline.

Can I change the expiry later?

Yes, with your OpenPGP app, as long as you have the private key.

Is my passphrase sent anywhere?

No. Keys are generated in your browser.

Where should I publish my public key?

On your website, in your security.txt, in email signatures or on keys.openpgp.org.

Related tools