PGP Key Generator

Create an OpenPGP key pair locally in your browser. Choose the recommended Curve25519 and Ed25519 option or RSA 4096, set an expiration period, protect the private key with an optional passphrase, and download the public key, private key, and revocation certificate.

Features

Curve25519 and RSA 4096 keysOptional passphrase protectionConfigurable key expirationPublic and private key downloadsRevocation certificate generationLocal browser processing

PGP Key Generator

Generate OpenPGP Keys
Real key generation with OpenPGP.js, processed only in this browser

How this generator works

OpenPGP.js generates a signing key, an encryption subkey, and a matching revocation certificate in a dedicated browser worker.

Before showing the result, WebUtils reopens both keys, verifies their fingerprints and user identity, unlocks passphrase-protected private keys, and tests the revocation certificate against a copy of the public key.

Curve25519 and Ed25519 are the recommended modern option. RSA 4096-bit is available when compatibility with older OpenPGP software matters more than generation speed.

How to use the PGP Key Generator

1Enter the name and email address that should appear in the OpenPGP user identity.
2Choose Curve25519 and Ed25519 or RSA 4096, then select an expiration period.
3Add a strong private-key passphrase unless you specifically need an unprotected key.
4Generate the key pair and verify the displayed user ID, key ID, and fingerprint.
5Download all three files, then store the private key and revocation certificate separately.

Common uses

Create a personal OpenPGP key for encrypted email or file exchange.
Generate a signing identity for releases, documents, or Git workflows that accept OpenPGP keys.
Replace an expiring key and retain a separate revocation certificate for recovery.

Public key, private key, and revocation certificate

Share the public key with people who need to encrypt data for you or verify your signatures. Keep the private key secret. Store the revocation certificate separately so you can mark the public key as revoked if the private key is lost or compromised.

Local generation and verification

Key generation runs in a dedicated browser worker. Before displaying the files, WebUtils reopens the public and private keys, compares their fingerprints, verifies the requested identity, checks passphrase unlocking when enabled, and tests the revocation certificate against a copy of the public key.

Algorithm compatibility

Curve25519 and Ed25519 provide a compact modern key pair and are the default. RSA 4096 takes longer to generate but remains available for software that requires RSA OpenPGP keys.

Frequently asked questions

Are my keys or passphrase uploaded?

No. Generation, validation, display, and downloads happen locally in your browser. WebUtils does not store the entered identity, passphrase, or generated key material.

Which file can I share?

Share only the public key. Keep the private key and its passphrase secret, and keep the revocation certificate in a separate secure location.

Should an OpenPGP key expire?

An expiration date limits how long the key is considered valid and is a practical default. You can extend an existing key later with OpenPGP software if you still control its private key.

What happens if I lose the private-key passphrase?

WebUtils cannot recover it. Use the separately stored revocation certificate to revoke the public key and create a replacement key pair.

PGP Key Generator

Features