PGP Encryption and Digital Signatures

What Is OpenPGP?

OpenPGP is a standard for cryptographic message protection.

It supports public-key encryption, digital signatures, and key management.

Cryptology Monster's PGP features operate on ASCII-armored OpenPGP keys and messages.

PGP Encryption

Encrypt a message using the recipient's public key.

Usage

Select PGP Operations.
Enter the plaintext message.
Paste the recipient's ASCII-armored public key.
Click Encrypt.
Copy the encrypted message.

Example Input

Confidential project information.

The recipient's public key typically starts with:

-----BEGIN PGP PUBLIC KEY BLOCK-----

Output

An encrypted OpenPGP message typically begins with:

-----BEGIN PGP MESSAGE-----

Only a holder of an appropriate private decryption key should be able to recover the plaintext.

PGP Decryption

Decrypt an armored OpenPGP message using the corresponding private key.

Usage

Select PGP Operations.
Paste the encrypted OpenPGP message.
Paste your ASCII-armored private key.
Enter the private-key passphrase if applicable.
Click Decrypt.
Review the plaintext.

Private-Key Format

An armored private key begins with:

-----BEGIN PGP PRIVATE KEY BLOCK-----

The private key must correspond to a recipient key used to encrypt the message.

Cleartext Signing

Cleartext signatures allow a message to remain readable while carrying a cryptographic signature.

Usage

Enter the message to sign.
Paste the signing private key.
Enter its passphrase if needed.
Click Sign (cleartext).
Copy the signed result.

Output Format

The generated message uses an OpenPGP cleartext signature structure similar to:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: ...

Signed message content

-----BEGIN PGP SIGNATURE-----
[Signature data]
-----END PGP SIGNATURE-----

The exact header and signature contents depend on the generated key and OpenPGP.js.

Signature Verification

Verification checks whether a cleartext signature corresponds to the supplied public key and signed content.

Usage

Paste the signed cleartext OpenPGP message.
Paste the signer's public key.
Click Verify.
Review the result.

Possible outcomes include:

Signature VALID

or:

Signature INVALID

Errors may also occur for malformed messages or incompatible keys.

What Does a Valid Signature Mean?

A valid cryptographic signature indicates that the signed content corresponds to a signature made with the private key associated with the supplied public key.

It does not independently establish the real-world identity of the signer.

For identity assurance, verify the public-key fingerprint through a trusted channel.

Encryption vs. Signing

Operation	Purpose	Key Used
Encrypt	Confidentiality	Recipient's public key
Decrypt	Recover plaintext	Recipient's private key
Sign	Authenticate signed content	Signer's private key
Verify	Check a signature	Signer's public key

Encryption does not automatically provide the same sender-authentication guarantees as an independently verified digital signature.

Key Compatibility

PGP Operations expect OpenPGP key material.

Native RSA-OAEP or Ed25519 PEM files generated by the separate keypair tools cannot simply be pasted into the PGP fields as equivalent OpenPGP armored keys.

Dependencies

The supplied application dynamically loads:

OpenPGP.js 5.11.1

from a CDN if the library is not already available.

If the library fails to load, the operation cannot proceed.

Security Recommendations

Verify Recipient Keys

Before encryption, confirm that the public key belongs to the intended recipient.

Protect Private Keys

Do not share your private key with other users.

Protect Passphrases

Use a strong, unique passphrase for private-key protection.

Preserve Revocation Material

Keep a secure copy of generated revocation certificates.

Verify Before Trusting

A valid signature is meaningful only when the verifying key is trusted.

Important: PGP protects messages through cryptographic keys. Correctly establishing who owns those keys is essential to secure communication.