CruxDevCruxDev Tools Prompts
security Utility • Zero-Server Privacy • 100% Client-Side

PGP / GPG Key Pair Generator

Generate RSA or ECC PGP key pairs in-browser with OpenPGP.js — export public and private keys in ASCII-armored format.

Overview

Generates a real RSA key pair in your browser via Web Crypto and presents it in PGP-style ASCII armor, with a name and email woven into the headers. An important honesty note: the armor wraps standard SPKI and PKCS#8 key material, not OpenPGP packets, so GnuPG will not import these blocks - but the RSA keys themselves are genuine.

How It Works

Enter a name and email for the identity comment, choose 2048 or 4096 bits, and press Generate Keypair. The public key block and private key block appear side by side, each click-to-copy. Generation takes a few seconds at 4096 bits. The private key panel is highlighted in orange to underline that it is the sensitive half. Nothing leaves the browser during or after generation.

Step-by-Step Usage Guide

  1. Type the name and email you want echoed in the Comment header of the armor.
  2. Choose the key size. 2048 bits generates quickly; 4096 takes longer and exceeds most encryption needs.
  3. Press Generate Keypair and copy the public block to wherever the test needs it.
  4. Copy the private block if your test requires it, and store it in a real secrets manager - the tool keeps no copy.

Technical Specifications & Standards

Under the armor, this is the same machinery as the site's RSA key generator: crypto.subtle.generateKey with RSA-OAEP, SHA-256 and exponent 65537, exported as SPKI (public) and PKCS#8 (private) DER, then base64-encoded in 64-character lines. The OpenPGP resemblance is in the wrapper - BEGIN PGP PUBLIC/PRIVATE KEY BLOCK, a Version line, and a Comment carrying the UID - not in the payload. Real OpenPGP (RFC 4880) encodes keys as a packet structure with its own algorithm IDs, self-signatures and creation timestamps, which is what GnuPG and keyservers expect; a PEM-wrapped SPKI block is a different container entirely, and gpg --import will reject it. The genuine value is a real, locally generated RSA key pair in a visually PGP-ish presentation: the keys are usable with WebCrypto RSA-OAEP operations, and the PKCS#8 private key imports into OpenSSL-based tooling directly. For actual PGP use, generate with GnuPG, Sequoia or a hardware token, which produce signed, self-certified OpenPGP packets. Use this tool to study key formats and to produce realistic armor for UI and parser testing.

Targeted Use Cases

  • Producing realistic PGP-looking key blocks for UI mockups, parser tests and documentation examples.
  • Teaching the difference between ASCII armor and the key material inside it, and why armor alone does not make a key an OpenPGP key.
  • Generating a genuine RSA key pair for WebCrypto encryption experiments without installing any tooling.
  • Testing how an application's key-input field handles multi-line PEM-ish blocks with headers and comments.

Notes & Gotchas

  • Do not attempt to import these blocks into GnuPG or a keyserver - they are PEM-wrapped SPKI/PKCS#8, not OpenPGP packets, and real clients will reject them.
  • Generate production PGP keys with GnuPG, Sequoia or a hardware token, where self-signatures and packet structure are handled correctly.
  • Treat the private block as sensitive from the moment it appears: copy it only into a secrets manager, never into chat or email.
  • Generate on a trusted machine. Local generation keeps the key off the network, not out of a compromised browser.

Frequently Asked Questions

Can GnuPG import this key?

No. The blocks are ASCII armor around X.509 SPKI and PKCS#8 structures, while OpenPGP expects its own packet format with self-signatures. gpg --import will report an error. The RSA key material itself is real and imports fine into OpenSSL-style tooling.

Are these real RSA keys?

Yes. They are generated by the browser's Web Crypto with the standard exponent 65537, at your chosen modulus size, and exported as standard DER structures. The PGP-styled wrapper is presentation; the keys underneath are genuine.

Does the name and email I type become part of the key?

Only textually, in the Comment header of the armor. A real OpenPGP key binds a User ID to the key with a cryptographic self-signature, which this format does not attempt. Nothing here cryptographically ties the identity to the key.

Is my private key safe here?

It never leaves the browser, and the tool stores nothing. But a browser tab is not a vault: the key is visible on screen and in page memory. For anything beyond testing, generate keys on infrastructure designed for it.