PGP Message Decryption
Decrypt a PGP message in your browser with your private key and passphrase, and verify the sender's signature. Nothing is uploaded and no keyring is needed.
How to use PGP Decrypt
- 1Paste the armored message that starts with -----BEGIN PGP MESSAGE----- (or open a .gpg or .pgp file).
- 2Paste your private key and its passphrase, or switch to passphrase-only if the message was encrypted that way.
- 3Add the sender's public key to verify a signature, then press Decrypt to read the text and see who it was encrypted for.
What makes it better
- Decrypts armored or binary PGP messages with a private key or a passphrase
- Signature status: signed and valid, signature invalid, signed but unchecked, or unsigned
- Lists the key IDs the message was encrypted to
- Friendly errors for a wrong passphrase, a non-matching key or a damaged message
- Runs in your browser: private keys and passphrases are never sent anywhere
About PGP Decrypt
PGP decryption turns an armored message back into readable text using the private key it was encrypted for. Paste the message and your private key, enter the passphrase if the key has one, and optionally add the sender's public key to check the signature. OpenPGP.js does the work in your browser, so the key, the passphrase and the text stay on your device.
Common uses
- Read an encrypted message that a colleague or service sent to your PGP public key.
- Confirm that a message really came from a known sender by checking its signature.
- Test that the key pair you just generated can decrypt what it encrypted.
- Recover text from an old encrypted note when GnuPG is not installed on the machine you are using.
Example
Input
-----BEGIN PGP MESSAGE----- … (paste an armored message) + your private key and passphrase
Result
Decrypted text, for example: Meet at the north gate at 9:30. Signed by 287FCF19B6528052 — valid
Good to know
- Pasting a private key into any web page is a risk: browser extensions, a compromised device or a malicious copy of a site can read it. Use this only on a device you trust, and prefer GnuPG for long-term keys.
- A valid signature proves the message matches the sender's key. It does not prove that the key belongs to the person you think, so verify fingerprints with the key owner out of band.
- If the private key or passphrase is lost, the message cannot be recovered by anyone. Decryption does not check for expired or revoked keys beyond what the message itself says.
PGP Decrypt FAQ
Why does PGP decryption say my passphrase is wrong?
The passphrase unlocks your private key, not the message. Check for typos, caps lock and trailing spaces, and make sure it belongs to the key you pasted. If you generated several keys, the passphrase only fits the one it was set on.
What does 'key does not match' mean?
Each PGP message records which public keys it was encrypted for. If none of the private keys you pasted correspond to those key IDs, the message was meant for someone else, or for another key of yours. Ask the sender which key they used.
How do I check who signed a PGP message?
Paste the sender's armored public key into the optional box before decrypting. The result then reads valid if the signature matches that key and invalid if the text was changed. Without the key it only shows the signing key ID as unchecked.
Can I decrypt a message that was encrypted with only a passphrase?
Yes. Switch to the passphrase-only option and enter the passphrase used to encrypt it; no private key is needed. This works for messages made with gpg --symmetric or by the Encrypt page's passphrase mode.
Why does decryption fail on a message I copied from email?
Email clients sometimes add quote marks, change line breaks or cut the last lines, which breaks the checksum. Copy the whole block from -----BEGIN PGP MESSAGE----- to -----END PGP MESSAGE----- from the original source and keep the blank line after the header.