What algorithm should I choose?

For new keys in 2026, ECC Curve25519 is the recommended default — small, fast, and modern. RSA-3072 or RSA-4096 remain widely compatible with older PGP tooling. Avoid RSA-2048 for long-term use.

Is my private key sent to any server?

No. Key generation runs entirely in your browser via OpenPGP.js. The private key is created locally and never leaves your device unless you download it or copy it yourself.

Why does my browser freeze briefly during RSA-4096 keygen?

It used to. Heavy crypto now runs in a dedicated Web Worker, so the UI stays responsive while the key is generated. Expect a few seconds for RSA-4096 even on fast machines — that is the algorithm, not the browser.

Should I set a passphrase?

Yes for any key you store on disk or share between devices. The passphrase encrypts the private key file so it is useless to anyone who steals the file without the passphrase.

What does the expiry date do?

The expiry date is signed into the key. PGP clients refuse to encrypt to or trust signatures from expired keys. Set 0 for a non-expiring key, or 1–10 years for a renewable working key. Shorter lifetimes are safer.

Schlüssel erzeugen

Erzeuge RSA- oder ECC-OpenPGP-Schlüsselpaare im Browser. Keine Daten werden an einen Server gesendet.

Alles läuft in Ihrem Browser — kein Server, kein Tracking.