THE PRACTICAL GUIDE · NORMANDIN SYSTEMS
Get more from PGP keygen
PGP keygen: Generate new random PGP private and public keys (with or without passphrase). OpenPGP keys combine cryptographic material with identity-related metadata used by compatible messaging and file-encryption workflows. A public-key pair contains related pieces with different roles. The private key must remain protected; the public key can be shared for the operations supported by the chosen algorithm. Key generation is only the start of a lifecycle that also includes format compatibility, distribution, backup, rotation, and revocation or replacement. Use disposable keys to confirm that an application accepts the generated format before creating material for a real deployment. Keep enough metadata to identify the algorithm and intended use, and never assume that two applications accept the same key container.
Guide updated October 13, 2026
How to use this tool
- Begin with a representative input. For a practical test, use: A demonstration identity and supported PGP key settings. Replace demonstration values only after you understand the output.
- Choose the key algorithm settings and any passphrase option exposed by the generator, using test values for an initial compatibility check.
- Generate the pair and distinguish the public output from the private output by their labels and format headers.
- Import a disposable pair into the intended application, test the intended operation, and then store any real private material securely.
SEE IT IN PRACTICE
A worked example
A demonstration identity and supported PGP key settings
An OpenPGP public/private key pair
Plan expiration, backup, and revocation handling before relying on a long-lived identity key.
Choose the key for a defined use
Start with the receiving application’s requirements rather than generating the largest or newest-looking option. A signing workflow needs a supported signature algorithm and key representation. Encryption may require a different key type or protocol. Elliptic-curve names and RSA sizes are part of that compatibility decision. Test a disposable export and import before creating a key that will be difficult to replace.
Plan the key’s lifecycle
Record purpose, owner, creation context, and any expiration policy without exposing the private material. Decide how the public key will be distributed and verified, how the private key will be backed up, and how a compromised or lost key will be replaced. A passphrase can protect a stored private-key file, but it does not remove the need for controlled access and recovery planning.
When this tool is useful
- Generate PGP test identities
- Inspect public-key export format
- Check an OpenPGP application import
Tips for a better result
- A self-declared name or email in a key does not independently prove that the key belongs to that person.
- Protect the private key and any passphrase separately from files or messages intended for public distribution.
- A public-key fingerprint is useful for comparing keys, but the comparison is meaningful only through a trusted channel.
Frequently asked questions
Why can two keys with the same algorithm label use different file formats?
The mathematical key type and its container are separate layers. Applications may expect different PEM labels, OpenPGP packets, or other serialization formats even when the underlying algorithm is compatible.
Why does a program reject a generated key?
It may require a different algorithm, curve, key size, PEM label, or container format. Check the destination’s import requirements and test with a disposable key before committing to a format.
What happens if the private key is lost?
The public key generally cannot reconstruct it. Depending on the use, losing a private key can prevent decryption, signing, or authentication. Plan appropriate backup and replacement procedures before relying on a key.
What happens to the information I enter?
The utility processes your input in this browser. Some tools retain field values in browser storage or the URL; avoid entering secrets in shareable fields. Page and asset requests still go to the hosting provider. Read the privacy and offline-use notes for details.