Free PGP Key Generator: Create a Key Pair Online

Yes. This one is free, with no sign-up, no email and no limits. Enter your name and email, choose Ed25519 or RSA 4096, add an optional passphrase, and download your public key, private key and revocation certificate as .asc files.

Enter your name and email in the tool above, pick a key type (Ed25519 is the modern default), optionally set a passphrase, and click Generate. Then download the three .asc files: the public key to share, the private key to keep secret, and the revocation certificate to save for emergencies.

The key is created locally by your browser using OpenPGP.js and the Web Crypto API, and nothing is uploaded, so ToolDeck never sees it. The remaining risk is your own device: browser extensions and malware can read what happens on a page. For a high-value key, such as one that protects a company or a long-term identity, generate it with GnuPG on a clean, trusted computer instead.

Yes. The keys are generated on your device using OpenPGP.js, a well-audited JavaScript library that implements the OpenPGP standard (RFC 9580). Randomness comes from the browser Web Crypto API, which uses the operating system CSPRNG. No part of the key material ever leaves your device.

No. There is no upload step and no server-side key handling. Open your browser network tab while generating a key and you will see no requests containing your name, email or passphrase. The only network activity is the initial page load and the OpenPGP.js library download.

Ed25519 is the modern default. It is faster to generate, produces much smaller keys, and is at least as strong as RSA 3072 by current cryptography standards. Choose RSA 4096 only if you need to interoperate with a very old PGP client that does not support Ed25519. Almost nobody needs RSA 4096 in 2026.

A fingerprint is a cryptographic hash of your public key, usually shown as 40 or 64 hex characters grouped in fours. It uniquely identifies the key. When you exchange keys with someone, verify the fingerprint out of band (voice call, Signal, in person) to make sure the public key you received is really theirs and not a fake.

A revocation certificate is a small signed file that says "this key is no longer valid". If your private key is ever lost, stolen or compromised, importing the revocation certificate into your keyring and publishing the updated public key tells everyone who has it to stop trusting the key. Without a revocation certificate, you cannot revoke a key after the fact. Save it the moment you generate it.

Yes, unless you have a very specific reason not to. A passphrase encrypts the private key file on disk with a symmetric cipher. Without it, anyone who copies the .asc file can immediately sign and decrypt messages as you. With it, they also need to guess or steal the passphrase. Use a long, unique passphrase that you store in a password manager. You can make one with our Password Generator.

Encrypt and sign email in Thunderbird, ProtonMail, or any OpenPGP client. Sign Git commits and tags (GitHub, GitLab and Gitea show a Verified badge). Encrypt files before backup or cloud upload. Join encrypted messaging services that speak OpenPGP. Verify signed software releases.

Save the three .asc files somewhere safe. Then open a terminal and run: gpg --import your-name-public.asc, then gpg --import your-name-private.asc. GnuPG will prompt for your passphrase once. Confirm with gpg --list-secret-keys --keyid-format=long and check that the fingerprint matches the one shown on this page.

PGP is the original commercial software from 1991. OpenPGP is the open standard (currently RFC 9580) that grew out of it. GPG (GnuPG) is the most widely used free implementation of OpenPGP. This tool uses OpenPGP.js, which is a JavaScript implementation of the same standard. All three produce compatible keys.

Yes. Both ProtonMail and Thunderbird accept standard ASCII-armored OpenPGP keys. In Thunderbird, go to Account Settings, End-to-End Encryption, and add your key there. In ProtonMail, open Settings, Encryption and Keys, and add an external key. Ed25519 and RSA keys generated here work in both.

You will not be able to decrypt future messages or sign new ones with that key. Anyone can still encrypt to your public key but you will not be able to read it. Use the revocation certificate you saved to publish a revocation, then generate a fresh key and tell your contacts to switch. This is why you always save the revocation certificate.

A primary key does not have to expire, but you can set an expiry date on the key or on subkeys. Many people set 1 to 2 years and extend before it runs out. This tool does not currently set an expiry, so keys generated here are valid until you revoke them.

Yes. A PGP key can have multiple user IDs, one per email address. Some people prefer a separate key per address for compartmentalisation. This tool currently generates one user ID per key. To add more, import the key into GnuPG and use gpg --quick-add-uid.

No. Ed25519 gives roughly 128-bit security, which matches RSA 3072 or higher. RSA 4096 gives around 140-bit security, a very small theoretical edge that is not relevant in practice because the bottleneck in real attacks is implementation bugs, weak passphrases or key theft, not brute force on the mathematical problem.

Key generation runs locally in your browser, so it does not send anything over the network. Once the page has loaded, generating a key does not need a connection. If you need a strict guarantee, such as for a high-security environment, use GnuPG on an offline computer instead.