What is a PGP key and why do you need one?
PGP is the standard you still use today to protect private email (ProtonMail), to sign Git commits on GitHub, and to verify the authenticity of software (Linux kernel, Ubuntu, signed package releases). You generate a keypair: a public key (you hand out to everyone) and a private key (you keep to yourself). Anyone can encrypt a message for you using your public key, but only you can read it.
Here you generate the pair right in your browser. Pick Ed25519 (the modern, fast elliptic curve) or classic RSA-2048/4096 (compatibility with any legacy tool). Keys come out in ASCII "armored" format, so you can paste them straight into Gmail, GitHub, or Keybase.
Everything runs in your browser. The private key never leaves your device. That is the core rule of PGP, only you know the private key.
How to use
- Enter your name and email, those fields are embedded into the public key as the "User ID".
- Optionally enter a comment (e.g. "GitHub", "work", "personal") if you keep several keys for different purposes.
- Passphrase for the private key: strongly recommended. Without it, anyone with file access can sign commits in your name.
- Pick the curve: Ed25519 for modern use (GitHub, ProtonMail), RSA-2048 for legacy systems, RSA-4096 when you want the largest safety margin (generation takes a few seconds).
- Pick the expiration: 1, 2, 5 years or never. Shorter expiration is better practice; the key can be rotated or revoked.
- Click Generate. You get a public key, a private key, the fingerprint (short identifier) and the key ID.
When to use it
Six common situations where a PGP key solves the problem:
- Encrypting email in ProtonMail/Tutanota/Thunderbird. Exchange public keys with a friend; from then on you both can encrypt for each other.
- Signing Git commits on GitHub. Add the public key to your account, commits get a green "Verified" badge.
- Verifying a Linux package signature. The PGP signature proves the package comes from the original author (apt-get, pacman).
- Identity on Keybase, ProtonMail key server, GitHub. Your public key is your cryptographic identity.
- Backing up a password or API key. Encrypt the file with your own public key, you can even push it to a public repo safely.
- Anonymous whistleblowing. Journalists and organizations (Wikileaks, ProPublica) publish their public key so sources can submit documents safely.
To encrypt text without keys (just a password), use AES encryption. For JWT signing see the JWT signer/verifier.