PGP Key Generator: Software to Use Instead of a Webpage

A PGP private key has to last. You'll use it for months or years, and everything encrypted to it depends on nobody else ever having seen it. A webpage is a bad place to create that key, because you have no way to confirm that the JavaScript your browser ran today is the same code anyone actually reviewed. A compromised CDN, a malicious ad script, or a quiet edit on the server can swap it out, and there's no audit trail on your end that would catch it.

Desktop PGP software doesn't have that problem. You install it once, from a source you can verify, and it runs the same code every time; nothing arrives fresh over the network every time you generate a key. That's the whole reason OpenPGP.js's own documentation and most serious security guides tell you to generate long-term keys with installed software, not a page you loaded a moment ago.

• Kleopatra (Windows): part of Gpg4win, a graphical front-end for GnuPG. Generates and manages keys through a proper UI, no command line required.
• GPG Suite (macOS): integrates GnuPG with Keychain and Mail, straightforward setup wizard.
• GnuPG (gpg) command line (Linux, Tails): pre-installed on Tails and most Linux distributions. Slightly steeper learning curve, full control.
• GPA (cross-platform): a lighter graphical alternative to Kleopatra when you want a GUI on Linux.

All four sit on top of the same underlying standard, so a key made in any one of them works with vendors and markets using any other. The PGP verification guide covers installing and generating your first keypair, step by step, per operating system.

The key itself is half the job. The other half is protecting it: a strong, memorized passphrase on the private key, a backup stored somewhere that isn't your primary device, and a policy of never pasting the private key into a form, a chat, or a webpage, ever, for any reason. Legitimate uses never ask for it.

And once you're actually using PGP to verify something, whether that's a vendor's message or a market's canary statement, the verification matters more than the encryption. A signature check catches a clone site that copied every pixel of the real one but can't forge a private key it doesn't hold.