All operations

PGP key

Paste a public key and get the fingerprint you would compare over the phone.

What it does

Reads an OpenPGP public key, the -----BEGIN PGP PUBLIC KEY BLOCK----- kind, and reports what is inside: the algorithm, when the key was made, the user IDs it claims, its subkeys, and above all the fingerprint.

The fingerprint is a hash of the key material itself, so it identifies the key the way a checksum identifies a download. Comparing fingerprints over a phone call or in person is the step that defeats a swapped key, and it only works if both people actually do it.

What is loaded above

Alice Lovelace is a sample identity published by the IETF for testing OpenPGP software, so her fingerprint is a public known answer: EB85 BB5F A33A 75E1 5E94 4E63 F231 550C 4F47 E38E. Paste any public key over it. Your own is exported with gpg --export --armor [email protected].

The command line is the stronger tool

GnuPG produces the same report:

gpg --show-keys --with-fingerprint --with-subkey-fingerprints key.asc

For a decision you intend to rely on, run that on your own machine. A tool that checks keys should itself be beyond question, and a web page is a poor candidate: you would be trusting this site, its host, and the connection to it, all to avoid one command. This page earns its keep elsewhere: on a machine without gpg installed, for a quick look at a key someone sent you, and for curious minds who want to see what actually lives inside a key block. Everything runs in your browser and nothing is uploaded, which you can confirm in the network tab: the page makes no requests after it loads.

What the report does not prove

A user ID is free text. Anyone can generate a key that says Satoshi Nakamoto <[email protected]>, and plenty of people have. The name on a key means nothing until you have confirmed the fingerprint with its owner through a channel the key did not travel over.

Expiry dates and usage flags come from the key’s self-signatures. This page parses those claims and displays them, and it does not verify the signatures. That caveat is printed in the report itself rather than hidden here.

Compare whole fingerprints, never key IDs. The short 32-bit IDs can be collided on a laptop, and even the full 64-bit ones have been brute-forced in bulk. The fingerprint is the only identifier worth reading to someone.

If you paste a secret key

The report will say so, loudly. The fingerprint only ever needs the public half, which is what gpg --export produces; --export-secret-keys is never required here. Nothing leaves this page either way, but a clipboard is no place for a private key you actually use.

The PGP word list turns a fingerprint into words designed to be read aloud without being misheard, which is exactly what you would do with the fingerprint this page produces. Hash is the general-purpose fingerprint for files and text. Inspect is the same idea as this page, pointed at text instead of keys.