PGP-Style Key Generation: What a Browser Can and Can't Safely Do
A real PGP (OpenPGP, RFC 4880) key is more than an RSA key pair — it's that key wrapped in a specific binary packet format, bound to an identity via a self-signature, and ASCII-armored for transport. None of that packet machinery exists in browser Web Crypto, and hand-implementing it is exactly the kind of custom cryptographic code that's risky to get subtly wrong. This tool is upfront about that limit: it generates real RSA key material and stops there.
For a true GPG-importable key, use GnuPG or a dedicated library like OpenPGP.js.
What Makes a Key 'PGP' Beyond the Math
The cryptography inside a PGP key (typically RSA or a modern elliptic curve) is the same math used elsewhere. What makes it specifically an OpenPGP key is the packet structure defined in RFC 4880: a public-key packet, a user ID packet containing your name and email, and a self-signature packet cryptographically binding the two together — plus, conventionally, ASCII armor for easy copy-pasting. A raw key pair alone isn't any of that.
Why This Tool Draws a Hard Line Here
It would be technically possible to hand-write RFC 4880 packet encoding, but a subtly incorrect implementation wouldn't necessarily error loudly — it might produce a file that looks like a PGP key but fails silently or behaves unpredictably when a real tool tries to import it. Being explicit about the limitation is safer than producing output that looks more complete than it actually is.
What You Actually Get, and What To Do With It
The RSA key pair this tool generates is real and cryptographically sound — usable directly for RSA signing or encryption tasks outside the PGP ecosystem, or as a reference to compare against a properly generated PGP key's underlying parameters. For anything that needs to actually work with GPG, Kleopatra, or another OpenPGP tool, generate the key with that tool directly.
Practical Examples
What This Tool Is Good For
A real key pair for non-PGP use.
- 1.Generate 4096-bit RSA key material
- 2.Use directly for RSA signing/encryption experiments
- 3.Not: import into GPG
Getting a Real GPG Key Instead
The correct path for actual PGP use.
- 1.Install GnuPG
- 2.Run: gpg --full-generate-key
- 3.Follow prompts for name, email, key type
What This Tool Provides
- Real RSA key generation: via native Web Crypto
- 2048 or 4096-bit options
- Standard PEM export: PKCS8 private, SPKI public
- Honest scope: not a substitute for real OpenPGP tooling
What It Deliberately Doesn't Attempt
- RFC 4880 packet framing
- Self-signature binding identity to key
- ASCII armor in the OpenPGP-specific format
- GPG/Kleopatra import compatibility
Frequently Asked Questions
Can I import this into GPG or Kleopatra?
No, and this tool is explicit about that upfront. A real OpenPGP key isn't just an RSA key — it's the RSA key wrapped in RFC 4880's specific packet structure, complete with a self-signature binding your identity (name/email) to the key, and ASCII armor. None of that packet framing is something browser Web Crypto can produce; this tool generates only the underlying RSA key pair.
Why not just implement the OpenPGP packet format too?
Because getting cryptographic packet framing subtly wrong is worse than not attempting it — a key that looks plausible but silently doesn't conform to spec could fail in ways that are hard to detect until it matters. If you need a real, working PGP key, use GnuPG or a properly audited library like OpenPGP.js, both of which exist specifically to get this exactly right.
What can I actually use the output for?
It's a real, valid RSA key pair in standard PEM format — usable anywhere a plain RSA key is needed (RS256 JWT signing, RSA-OAEP encryption, general cryptographic experimentation). It's a building block, not a finished PGP identity.
What's the typical key size for PGP keys?
4096-bit RSA has become a common modern default for PGP identities intended for long-term use, though 2048-bit remains acceptable and faster to generate. Many PGP tools also now support ECC (Curve25519) keys, which this generator doesn't produce.
How do I get a real GPG key with a name and email attached?
Run gpg --full-generate-key from the command line (after installing GnuPG), which walks you through identity details and produces a properly packet-framed, self-signed, armored key ready to import into any OpenPGP-compatible tool.
Is my key sent anywhere?
No, generation happens entirely in your browser via the Web Crypto API — nothing is transmitted.