Create an OpenPGP key pair for encrypted email and signed messages. Choose Curve25519 or RSA, add your name, email, passphrase and expiry, then download the armored public key, private key and revocation certificate. Keys are generated on your device with OpenPGP.js.
Enter your name and email. They form the user ID people see when they import your key.
Choose the key type. Curve25519 is fast, modern and the default in GnuPG; RSA 4096 suits very old software.
Set a strong passphrase and an expiry date. You can extend the expiry later with GnuPG.
Press Generate keys. Generation takes under a second for Curve25519 and a few seconds for RSA 4096.
Download all three files: share the public key, keep the private key and revocation certificate somewhere safe and offline.
What you get
File
Starts with
What to do with it
Public key
-----BEGIN PGP PUBLIC KEY BLOCK-----
Share it: email signature, website, keyserver (keys.openpgp.org), or send it to people who want to write to you.
Private key
-----BEGIN PGP PRIVATE KEY BLOCK-----
Import it into your own OpenPGP software and back it up offline. Never send it to anyone.
Revocation certificate
-----BEGIN PGP PUBLIC KEY BLOCK----- (with a revocation comment)
Keep it offline. Import it only if the key is lost or compromised, then republish your public key.
Each key has a primary key for signing and certifying and a subkey for encryption. For Curve25519 that is an Ed25519 primary key and a Cv25519 (X25519) encryption subkey, the same layout gpg --quick-gen-key creates by default.
GnuPG 2.1+ and most modern software; preferred by some compliance rules
RSA 3072 / 4096
~128 / ~140-bit
Large
Everything, including very old PGP versions
RSA 2048
~112-bit
Medium
Everything; considered the minimum today
Using the keys with GnuPG
# import both keys
gpg --import [email protected]
gpg --import [email protected]
# mark your own key as ultimately trusted
gpg --edit-key [email protected] trust quit
# encrypt and decrypt a file
gpg --encrypt --recipient [email protected] notes.txt
gpg --decrypt notes.txt.gpg
# extend the expiry by two years later
gpg --quick-set-expire FINGERPRINT 2y
Frequently asked questions
What is a PGP key pair?
OpenPGP (RFC 4880) uses two keys. The public key is shared so others can encrypt messages to you and verify your signatures. The private key, protected by a passphrase, decrypts those messages and creates signatures. Never share the private key.
Which key type should I choose?
Curve25519 (Ed25519 for signing, Cv25519 for encryption) is the default in GnuPG 2.3+ and gives strong security with tiny keys and fast operations. Choose RSA 3072 or 4096 only if you must exchange messages with very old software that lacks ECC support.
Is it safe to generate PGP keys in a browser?
The keys are created by the open-source OpenPGP.js library, which runs entirely on your device using the browser's secure random number generator. Nothing is uploaded and the page keeps no copy. Close the tab after downloading the keys. For high-value keys you may still prefer to generate them offline with GnuPG.
What is the revocation certificate for?
If your private key is lost or stolen, import the revocation certificate into GnuPG and publish the updated public key. Everyone who refreshes your key will see that it must no longer be used. Store it separately from the private key.
How do I import the keys into GnuPG?
Run gpg --import publickey.asc and gpg --import privatekey.asc. You will be asked for the passphrase when importing or using the private key. Kleopatra, GPG Keychain and Thunderbird have an Import button that accepts the same .asc files.
Should my key expire?
Yes, an expiry date is a safety net: if you lose access to the key, it stops being used automatically. You can extend the expiry at any time while you still have the private key (gpg --edit-key, then expire), so 2 or 3 years is a common choice.
Can I recover a forgotten passphrase?
No. The private key is encrypted with your passphrase and there is no way around it. Write it down or keep it in a password manager, and keep the revocation certificate so you can at least retire the key.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.