Question 1

What is a fingerprint and why does it matter?

Accepted Answer

A fingerprint is a SHA-1 (v4) or SHA-256 (v6) hash of the public key. It is the only safe way to identify a key — public-key text can be edited; the fingerprint cannot. Compare fingerprints out-of-band before trusting a key.

Question 2

Why does my key say "unsafe" or "weak"?

Accepted Answer

RSA below 3072 bits and certain DSA configurations are flagged. They will work technically but offer limited resistance to well-funded attackers and are deprecated by NIST/IETF for long-term use.

Question 3

Does Inspector send my key anywhere?

Accepted Answer

Parsing is local. Keyserver lookup, when explicitly requested, sends only the email address (not the key) to keys.openpgp.org over HTTPS. Air-gap mode disables that lookup.

Question 4

What is randomart?

Accepted Answer

A small ASCII pattern derived from the fingerprint. Humans recognize visual changes much faster than they spot a flipped hex digit, so randomart helps catch substitution attacks during fingerprint verification.

Question 5

Can Inspector read private keys?

Accepted Answer

Yes — it shows the same metadata for private keys as for public keys, plus a flag indicating whether the private material is passphrase-encrypted. The private material itself is never displayed.

فاحص المفاتيح