PGP Key Generator

Generate secure RSA public/private key pairs with OpenPGP standard (RFC 4880)

Generated Keys
Identity: | Cipher: | Key Size: -bit
Your name or email for the key
Protects your private key. Customize
Passphrase Generation Options
AES-256 offers maximum security with 256-bit encryption. Legacy algorithms provided for compatibility only.
2048-bit provides strong security with good performance. 1024-bit is weak and not recommended.

Support This Free Tool

Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.

500K+ users
200+ tools
100% private
☕ One-time support Buy me a coffee 📚 Learn & support 9-Book Bundle - $9 Stay updated Follow @anish2good
Privacy Guarantee: Private keys you enter or generate are never stored on our servers. All tools are served over HTTPS.

Cryptographic Key Generation Methodology

RSA Key Pair Generation Process

This tool generates PGP key pairs using the RSA (Rivest-Shamir-Adleman) public-key cryptosystem. The generation process follows these cryptographic steps:

  1. Prime Number Generation: Generate two large random prime numbers (p and q)
  2. Modulus Calculation: Compute n = p × q (the key size determines the bit length of n)
  3. Totient Function: Calculate φ(n) = (p-1)(q-1)
  4. Public Exponent: Choose public exponent e (commonly 65537) where 1 < e < φ(n) and gcd(e, φ(n)) = 1
  5. Private Exponent: Compute private exponent d where d ≡ e⁻¹ (mod φ(n))
  6. Key Packaging: Format keys according to OpenPGP standard (RFC 4880)

Cipher Algorithm Options

Algorithm Block Size Key Size Security Level
AES-256 128 bits 256 bits Highest (recommended)
AES-192 128 bits 192 bits High
AES-128 128 bits 128 bits High
TWOFISH 128 bits 256 bits High
BLOWFISH 64 bits 32-448 bits Medium (legacy)
CAST5 64 bits 128 bits Medium
TRIPLE_DES 64 bits 168 bits (effective 112) Medium (legacy)

Key Size Selection Guide

  • 1024-bit: Legacy support only. No longer recommended for new keys (vulnerable to advanced attacks).
  • 2048-bit: Current standard recommendation. Provides strong security with good performance balance.
  • 4096-bit: Maximum security for long-term protection. Slower performance but resistant to future computational advances.
Best Practice: Use 2048-bit or 4096-bit keys with AES-256 cipher for new key generation. Avoid 1024-bit keys unless required for legacy system compatibility.

Author Credentials & Expertise

Created by Anish Nath - Security Engineer specializing in cryptography and network security.

  • Experience: 15+ years in cybersecurity, cryptographic implementations, and secure system design
  • Expertise: OpenPGP/GPG implementations, public-key infrastructure (PKI), symmetric/asymmetric encryption algorithms
  • Standards Knowledge: Deep understanding of RFC 4880 (OpenPGP), NIST cryptographic guidelines, FIPS 140-2 requirements
  • Contact: @anish2good on X (Twitter)
Implementation Note: This tool uses the Bouncy Castle cryptographic library, a widely-trusted and FIPS-certified implementation used by enterprises worldwide. Key generation occurs server-side with cryptographically secure random number generation (CSRNG).

Trust & Privacy Guarantees

Zero Data Retention Policy

  • Generated keys are never stored on our servers
  • Keys are generated, displayed once, and immediately discarded from server memory
  • No logging of identity, passphrase, or generated key material
  • Optional email delivery uses temporary storage (deleted after sending)
  • No tracking cookies or analytics on this tool page

Security Recommendations

  1. Passphrase Strength: Use a passphrase with at least 16 characters, combining uppercase, lowercase, numbers, and symbols.
  2. Private Key Protection: Store your private key securely offline. Never share it or upload it to cloud services.
  3. Key Backup: Maintain encrypted backups of your private key in multiple secure locations.
  4. Key Expiration: Consider setting expiration dates for keys (managed in GPG client software after generation).
  5. Key Revocation: Generate and store a revocation certificate immediately after key creation.
Critical Warning: If you lose your private key or forget your passphrase, encrypted data cannot be recovered. There is no backdoor or password reset mechanism in PGP encryption.

Technical Implementation Details

OpenPGP Standard Compliance

This tool strictly adheres to RFC 4880 (OpenPGP Message Format) and generates keys compatible with:

  • GnuPG (GPG): The GNU Privacy Guard implementation
  • PGP Desktop: Symantec PGP Desktop and similar commercial implementations
  • OpenKeychain: Android OpenPGP implementation
  • Mailvelope: Browser extension for webmail encryption
  • Thunderbird/Enigmail: Email client PGP integration

Key Format Details

Generated keys use the following specifications:

  • Key Type: RSA (Sign + Encrypt)
  • Key Format: ASCII-armored PGP format
  • Private Key Protection: Encrypted with user-provided passphrase using String-to-Key (S2K) convention
  • Hash Algorithm: SHA-256 for signatures
  • Compression: ZLIB compression enabled

Random Number Generation

Security of RSA keys depends critically on unpredictable prime number generation. This implementation uses:

  • CSRNG Source: /dev/urandom on Linux (cryptographically secure)
  • Entropy Pool: System entropy pool with hardware RNG support when available
  • Primality Testing: Miller-Rabin primality test with multiple rounds

Common Use Cases & Best Practices

When to Use This Tool

  • Email Encryption: Generate keys for encrypting sensitive emails
  • File Encryption: Create keys for encrypting confidential documents
  • Code Signing: Generate keys for signing software releases or Git commits
  • Secure Messaging: Create keys for encrypted chat applications
  • Password Manager: Generate keys for GPG-encrypted password stores

After Key Generation

  1. Test Your Keys: Use the PGP Encryption/Decryption tool to verify your keys work correctly
  2. Publish Public Key: Upload your public key to keyservers (keys.openpgp.org, keyserver.ubuntu.com)
  3. Key Fingerprint: Verify key fingerprints when exchanging keys with others
  4. Web of Trust: Have your key signed by trusted parties to build trust relationships
  5. Regular Testing: Periodically test decryption to ensure you haven't lost access to your private key

Authoritative Sources

Quick Access