cross research network

Encrypt a message

Paste a recipient's OpenPGP public key, write a message, and get back an ASCII-armored PGP message to email them. Everything runs in this tab using OpenPGP.js; nothing is uploaded anywhere.

This runs entirely in your browser. The key and message never leave this page — there is no server call, no analytics and no form submission involved in encrypting. This tool only encrypts. Never paste a private key here; it has no use for one and should never see one.

1. Recipient's public key

2. Your message

3. Encrypted message

Overview

OpenPGP lets you encrypt a message so that only the holder of a matching private key can read it, and lets that person prove who they are by signing what they send. The format is an open standard — most recently RFC 9580 (2024), which supersedes the older RFC 4880 — so keys and messages made with one compliant tool work with any other. To use this page you need the recipient's public key, which they can safely hand out to anyone; only their private key, which never leaves their own machine, can decrypt what you send them.

Don't have a key yet, or need one for yourself? Generate a keypair with GnuPG (bundled with most Linux distributions; Gpg4win packages it for Windows and GPGTools for macOS), then export the public half and share that — see the command-line section below for the exact commands.

Webmail

Outlook on the web does not speak OpenPGP natively. The straightforward route with a browser-based mailbox is to encrypt here, then copy the armored block (the text starting with -----BEGIN PGP MESSAGE-----) into the body of a new message. The recipient pastes it into their own OpenPGP-aware client to decrypt. If you'd rather have encryption happen automatically as you type and read mail in the browser, a webmail-integrated extension such as Mailvelope can manage keys and handle this inline.

GNU/Unix

On Linux, BSD and macOS, GnuPG (the gpg command) is the standard implementation and reads the same armored keys and messages this page produces. A short cheat-sheet: 

gpg --full-generate-key

Create your own keypair. Prefers modern defaults over the older gpg --gen-key.

gpg --export --armor <key-id> > public.key

Export your public key to share it — this is the text to paste into this page's key field.

gpg --import recipient.key

Import someone else's public key into your own keyring.

gpg --list-keys

List the keys currently in your keyring, with fingerprints.

gpg --encrypt --armor --recipient <key-id> file

Encrypt a file from the command line instead of this page — produces file.asc.

gpg --decrypt file.asc

Decrypt a message you received, using your own private key.

Email clients

Thunderbird has built-in OpenPGP support since version 78, under Account Settings → End-To-End Encryption — no add-on required (the older Enigmail add-on it replaced is discontinued). Claws Mail supports OpenPGP through its bundled PGP/Core plugin. On any client without native support, generate and manage keys with GnuPG and encrypt or decrypt through it directly, or use a browser extension such as Mailvelope for webmail. The openpgp.org software page keeps a current list of compatible clients.

About this tool

This page encrypts using OpenPGP.js, an open-source (LGPL-3.0+) implementation of the OpenPGP standard in JavaScript, loaded locally from this site rather than a third-party CDN. It only encrypts to a public key you supply; it has no decryption or key-generation function, and never asks for or transmits a private key.