PGP/GPG Keypair Generator

PGP, GPG and OpenPGP in 2026

PGP (Pretty Good Privacy) was written by Phil Zimmermann in 1991 and distributed for free over Usenet. Because PGP used strong cryptography, the US government opened a criminal investigation (1993–1996) under Cold War-era arms export controls, which Zimmermann famously circumvented by publishing the entire source code as a book — speech, not a munition. The case helped end export restrictions on civilian cryptography. GPG (GNU Privacy Guard) is the free-software replacement built by Werner Koch starting in 1997 and remains the dominant implementation today. The protocol itself is standardised as OpenPGP in RFC 4880 (2007) and the recently completed "crypto-refresh" RFC 9580 (2024), which finally cleans up legacy ciphers and adds modern AEAD modes.

A PGP "key" is really a bundle: a long-lived master key for signing identities plus one or more subkeys for encryption, message signing and authentication. Best practice is to keep the master key offline (cold storage on a USB stick in a safe) and only carry the subkeys on your laptop or phone — if the laptop is compromised you revoke and reissue subkeys without losing your web-of-trust signatures. The two algorithm families in current use are RSA 4096 (legacy default, universally supported) and Ed25519 / Curve25519 (modern, smaller, faster, mandated by RFC 9580).

What people actually use PGP for today

• Git commit and tag signing — the Linux kernel, Debian and many other projects gate releases on PGP signatures. GitHub shows a "Verified" badge for signed commits.
• Software release verification — Tor Project, Debian packages, Tails, BIND, Apache, and most Linux distros ship .sig files you check with gpg --verify file.tar.gz.sig file.tar.gz.
• Encrypted email — still alive in journalism and incident response, but mostly displaced by Signal, Wire and Matrix for casual messaging.
• Password and backup encryption — symmetric mode (gpg -c file) is a perfectly reasonable file encryptor.
• SSH and disk authentication — via gpg-agent with SSH support, or a YubiKey using the OpenPGP card protocol.

Tooling

On the command line, gpg is the universal tool: gpg --full-generate-key to create one (pick ECC and Curve25519 in 2026), gpg --export -a [email protected] to print an ASCII-armored public key, gpg --verify / --encrypt / --decrypt for the obvious operations. GUIs: Kleopatra on Windows (part of Gpg4win), GPG Suite on macOS, Seahorse on GNOME, OpenKeychain on Android. Mail integration: Thunderbird ships built-in OpenPGP since 2021, Mailvelope for webmail. For storing the private key in hardware, the YubiKey 5 implements the OpenPGP card spec and holds signing, encryption and authentication subkeys simultaneously.

Strong warning about this page

Never generate a real PGP keypair on someone else's website. The whole identity model of OpenPGP rests on the assumption that nobody but you has ever touched the private key bytes. Even when generation runs in your browser, you cannot audit the page you loaded, your extensions, your DNS, or whether the host quietly POSTed a copy somewhere. Use this tool to look at the ASCII-armor format and to integrate against a parser in development. For your real identity, run gpg --full-generate-key offline. Public keyservers: keys.openpgp.org (modern, validates email ownership) is the recommended upload; pgp.mit.edu still exists but accepts unvalidated junk.

FAQ

Is PGP still relevant in 2026? Yes — for git commit signing, software release verification and a stubborn niche in journalism and incident response. For everyday chat, Signal won.

Is it complicated to use? Famously. Usability has been the long-running criticism since the 1999 paper "Why Johnny Can't Encrypt". Modern subkey workflow plus a YubiKey makes it manageable for technical users.

What is a simpler alternative? For messaging, Signal or Wire. For signing software artifacts, Sigstore / cosign (OIDC-based, no long-lived keys). For S/MIME (X.509 CAs), corporate Microsoft and Apple stacks already integrate it.

What is the web of trust? A decentralised PKI where users sign each other's keys at keysigning parties to attest identity. Largely abandoned in practice; modern replacements are TOFU plus identity-validating keyservers like keys.openpgp.org.

Is the key generated here usable for real email? No. Treat the output as a format demonstration. Generate your real key with gpg on your own machine.