PGP Message Tool
Encrypts and decrypts OpenPGP messages with a passphrase, entirely in the browser — RFC 4880 symmetric mode (AES-256, SHA-256 S2K, MDC), interoperable with gpg -c. Public-key encryption and signatures are not built.
Symmetric OpenPGP — `gpg -c` — is the simplest way to hand someone an encrypted block of text when you have a passphrase you can share and no key infrastructure between you. This does exactly that side of OpenPGP, in the browser, and is deliberately explicit about the side it does not do.
Encryption and decryption both happen inside this tab. The passphrase, the message and the file never reach a server.
- Passphrase (symmetric) mode only — the same format as gpg -c (RFC 4880: AES-256, SHA-256 S2K, MDC), so a message made by gpg opens here and a message made here opens with gpg --decrypt. Public-key encryption and signature verification are not built.
The secret you have to share with the recipient through a different channel.
or drop a file
With a file present, the file is encrypted instead of the message. The result is armoured text (.asc).
How to use it
Paste the message and set a passphrase
The passphrase is turned into a key with the OpenPGP S2K function (SHA-256, iterated and salted) and the message encrypted with AES-256 under it.
Send the armoured block
The output is a standard `-----BEGIN PGP MESSAGE-----` block, so it survives being pasted into e-mail or a ticket without corruption.
Decrypt here or with gpg
This is RFC 4880 symmetric mode, so `gpg -d` on the recipient’s machine reads it, and this page reads what `gpg -c` produced. The MDC is checked on decryption, so tampering fails rather than silently succeeding.
Common questions
Can I encrypt to someone’s public key?
Not here. This is passphrase mode only — no public-key encryption, no key generation, no signing and no signature verification. If you need those, use GnuPG; a half-built implementation of public-key OpenPGP would be worse than none.
How do I get the passphrase to the recipient?
Not in the same message — that is the whole failure mode of this scheme. Use a different channel, or the self-destructing note tool.
Does the message reach a server?
No. Encryption and decryption both run in the tab, with no request at any point.
gpg says “no valid OpenPGP data found”.
The armour block has almost certainly been reflowed — a mail client wrapping long lines, or a chat app inserting spaces, breaks the base64. Send it as an attachment or in a code block.
Feed it from
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
TOTP Code Generator
Turns a TOTP secret into the current six-digit code with a countdown, for testing 2FA setups.
File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Next
These accept what this tool produces, so the result can go straight in.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
Text Encrypt & Decrypt
Encrypts a message with AES-GCM from a passphrase and produces a self-contained Base64 blob.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Archive Inspector
Opens a zip without extracting it and flags path traversal entries, executables, macros and zip bombs.