Skip to main content

PGP Tool — a 100% client-side privacy toolkit

PGP encryption, password generation, encrypted serverless paste, and metadata stripping — all running in your browser. No server, no tracking, no account required.

PGP Tool is an open-source privacy toolkit that runs entirely in your browser. Generate keys, encrypt and decrypt messages and files, sign and verify documents, and manage every PGP workflow without sending anything to a server. Your private keys never leave your device.

The toolkit covers the full PGP feature set — RSA and ECC key generation, public-key and symmetric encryption, clearsign and detached signatures, key inspection with optional keyserver lookup, Shamir's Secret Sharing for splitting private keys, time-lock encryption via the Drand beacon, dead-man's switch, steganography, document notarization, and more.

It also bundles a cryptographic password generator, a password-strength tester, a serverless encrypted paste service that lives in the URL itself, and a metadata stripper for images, PDFs, MP3s, and Office documents.

All of this is MIT-licensed, open source, and works offline once installed as a Progressive Web App. An air-gap mode disables every network request with one click for maximum security.

Frequently asked questions

Is PGP Tool safe to use?
Yes. PGP Tool runs 100% in your browser — no data is ever sent to a server. All encryption and decryption happens client-side using OpenPGP.js. The code is open source under MIT license.
Can I use PGP Tool offline?
Yes. PGP Tool is a Progressive Web App (PWA) that works fully offline once installed. Enable air-gap mode to disable all network requests for maximum security.
What encryption algorithms does PGP Tool support?
PGP Tool supports RSA (2048–4096 bit) and ECC (Curve25519, P-384) for key generation, AES-256-GCM for symmetric encryption and Secure Paste, and PBKDF2 or Argon2id for key derivation.
How does Secure Paste work without a server?
Secure Paste encodes the paste content directly into the URL fragment (after the # symbol). Optionally, content is encrypted with AES-256-GCM before encoding. The URL IS the paste — no server or database is involved.