Online/Offline PGP Tools

A simple offline-capable toolkit for generating OpenPGP keys, encrypting and decrypting messages, signing text and files, and verifying signatures.

Start Here: Generate Key Pair

Create your own private key and public key.

Open Tool How to use

Encrypt Message

Use the recipient's public key to encrypt a message.

Open Tool How to use

Decrypt Message

Use your private key and password to read encrypted messages.

Open Tool How to use

Sign Text

Use your private key to prove a message came from you.

Open Tool How to use

Verify Signed Text

Use the sender's public key to verify authenticity.

Open Tool How to use

Sign File

Create a detached .asc signature for any file.

Open Tool How to use

Verify File Signature

Check that a downloaded file was signed and not modified.

Open Tool How to use

What is PGP?

PGP is a system for protecting messages and files. It can be used for two main purposes:

Encryption: keeping data private so only the intended recipient can read it.
Signing: proving that a message or file came from a particular key and was not changed.

Public key and private key

OpenPGP uses a key pair:

Public key: safe to share. Other people use it to encrypt messages to you or verify your signatures.
Private key: keep secret. You use it to decrypt messages and create signatures.

Your private key should be protected with a strong password.

PGP, OpenPGP, GPG, and OpenPGP.js

PGP means Pretty Good Privacy, the original software and idea.
OpenPGP is the open standard for compatible PGP-style encryption.
GPG / GnuPG is a popular free command-line program implementing OpenPGP.
OpenPGP.js is the JavaScript OpenPGP library used by these browser tools.

Simple summary: PGP is the idea, OpenPGP is the standard, GPG is a program.

How to use OpenPGP step by step

1. Create a key pair

Use Generate Key Pair to create your private key and public key. Keep the private key secret. Share the public key with people who need to encrypt messages to you or verify your signatures.

2. Encrypt a message

To send a private message to someone, use their public key. Only their private key can decrypt it.

3. Decrypt a message

When someone sends you an encrypted message, use your private key and password to decrypt it.

4. Sign text

Signing proves that a message was created by the holder of the private key. It does not hide the message.

5. Verify signed text

Use the sender's public key to check whether the signed message is valid and unchanged.

6. Sign a file

A file signature creates a separate .asc file. The original file is not changed.

7. Verify downloaded files

For software downloads, especially security-sensitive software, verify the file using the developer's public key and the matching signature file before running it.

Why file signatures matter

File signatures are important for security-sensitive downloads such as crypto wallets, password managers, encryption tools, operating system images, and software installers.

A valid OpenPGP signature can help confirm that:

the file was signed by the expected developer or project key;
the file was not modified after signing;
the downloaded executable matches the file approved by the signer.

A valid signature proves that the file matches the signing key. It does not automatically prove that the key itself is trustworthy. Always obtain public keys from official project sources and compare fingerprints when available.

Tool guide

Generate Key Pair

Purpose: create a new password-protected private key and matching public key.

Inputs: name, email, optional comment, password, key type, expiration.
Outputs: private key and public key.
Use when: you do not yet have an OpenPGP key pair.

Open Generate Key Pair

Encrypt Message

Purpose: encrypt text so only the recipient can read it.

Inputs: recipient's public key and plaintext message.
Output: armored encrypted PGP message.
Important: encrypt with the recipient's public key, not your own, unless you are encrypting to yourself.

Open Encrypt Message

Decrypt Message

Purpose: decrypt a message that was encrypted to your public key.

Inputs: your private key, private key password, encrypted message.
Output: decrypted plaintext.
Important: your private key is sensitive. Use offline when possible.

Open Decrypt Message

Sign Text

Purpose: create a clear-signed text message that others can verify.

Inputs: your private key, password, plaintext message.
Output: signed PGP message.
Use when: you want to prove that a text message came from your key.

Open Sign Text

Verify Signed Text

Purpose: verify that a signed text message is authentic and unchanged.

Inputs: sender's public key and signed message.
Output: valid or invalid result, plus signed text.
Use when: someone sends you a PGP signed message.

Open Verify Signed Text

Sign File

Purpose: create a detached armored signature for a local file.

Inputs: your private key, password, file to sign.
Output: .asc signature file.
Use when: you want others to verify that a file came from you and was not modified.

Open Sign File

Verify File Signature

Purpose: verify a detached signature for a downloaded file.

Inputs: developer's public key, downloaded file, matching .asc or .sig signature.
Output: success or failure, signer key ID, and key user IDs when available.
Use when: verifying executables, wallets, installers, archives, or documents.

Open Verify File Signature

Security notes

These pages do not upload data, but private keys still exist in browser memory while in use.
For sensitive operations, use the tools offline and close the browser afterward.
Do not load openpgp.min.js from a CDN for sensitive use. Keep it local in the JS folder.
Use strong private-key passwords.
Keep private keys secret. Share only public keys.
For file verification, obtain public keys from official sources and compare fingerprints if available.
Browser tools are convenient. Dedicated GPG software may be preferable for long-term key management.