Skip to main content
Security & Privacy
Companion Guide • Security & Privacy

How to Inspect & Verify OpenPGP Keys Online

Learn how to decode OpenPGP public and private keys, verify 40-character fingerprints, inspect subkey capabilities, and check validity without server uploads.

Updated November 10, 2026
7 min read
Intermediate

In-Browser OpenPGP.js Cryptographic Engine

Files remain in local browser memory. Processing runs client-side.

1. Local Ingest

Your browser queries local file headers or byte structures directly using standard HTML5 File APIs.

Client Memory
2. Browser Processing

The data is loaded exclusively into your browser's isolated session memory (RAM).

3. Generated Output

Outputs (like compiled results or CSV logs) are written directly to your system download folder.

1. Understanding OpenPGP Key Architecture

OpenPGP (defined by RFC 4880 and RFC 9580) is the open standard for public-key encryption and digital signatures. An OpenPGP key is not a single cryptographic key. It is a structured chain of packets containing a primary master key, attached user identity certificates (User IDs), digital self-signatures, and specialized subordinate keys called subkeys.

Interactive Diagram

OpenPGP Key Packet Hierarchy & Subkey Tree

Local System Your files remain on disk
No Network Transit
Browser RAM Isolated Sandbox

In modern operational security, the primary key is reserved exclusively for Certifying [C] other keys and issuing revocations. Routine operations, such as signing Git commits [S], decrypting confidential files [E], or authenticating SSH sessions [A], are delegated to attached subkeys.

2. Interactive Workspace Anatomy & Control Breakdown

Master every control, parameter slider, and export action in the interactive workspace:

Workspace Controls & Parameter Specification

1. Armored Text & File Dropzone

Paste ASCII-armored blocks (-----BEGIN PGP PUBLIC KEY BLOCK-----) or drop binary .gpg and .asc key files.

2. Packet Structure & Type Indicator

Displays whether the key is an OpenPGP Public Key (Packet Tag 6) or Secret Key (Packet Tag 5).

3. Cryptographic Algorithm & Key Length

Identifies encryption algorithm (RSA 2048/4096-bit, Ed25519, Curve25519) and key strength.

4. Primary User ID & Validity Status

Extracts user full name, email, optional comment, creation timestamp, expiration date, and Active/Expired badge.

5. 40-Character Hex Fingerprint Tool

Formatted 4-character spaced fingerprint with a dedicated button to copy the unspaced 40-character Raw Hex string.

6. Subkeys Capabilities Matrix

Inspects secondary subkeys, detailing separate Key IDs, algorithms, and capabilities (Encrypt, Sign, Authenticate).

3. Fingerprints vs Short Key IDs

Historically, terminal utilities displayed truncated 8-character (32-bit) or 16-character (64-bit) Key IDs for human convenience. In modern cryptography, relying on short Key IDs is dangerous:

Feature / Metric
Unoptimized / Standard
Optimized / SHRTX Strategy
Short Key ID (8 hex chars / 32 bits)
Legacy GPG output (e.g. 0x12345678)
Critically unsafe. Trivial to forge using MD5 or SHA-1 birthday collisions.
Long Key ID (16 hex chars / 64 bits)
Mid-era GPG standard (e.g. 0x0123456789ABCDEF)
Deprecated. Vulnerable to targeted GPU cluster vanity collision attacks.
Full Fingerprint (40 hex chars / 160 bits)
Complete SHA-1 / SHA-256 hash digest
Cryptographically secure. The only safe standard for identity verification.
Primary Key vs Subkey
Certification only [C]
Dedicated subkeys for Encryption [E], Signing [S], and Authentication [A]
The Short Key ID Collision Threat
Attackers can generate a malicious RSA or ECC key pair whose truncated 8-character or 16-character Key ID matches your legitimate key within hours using standard desktop GPUs. When sharing or verifying keys, always compare the complete 40-character hexadecimal fingerprint.

4. Step-by-Step Key Verification Walkthrough

Verify public keys received from colleagues, software vendors, or open-source maintainers:

1

Paste ASCII Armored Key Block

Paste raw PGP key text beginning with BEGIN PGP PUBLIC KEY BLOCK into the input panel.

2

Decode Primary Header & Algorithm

Review the key classification (Public or Secret), OpenPGP version, and asymmetric algorithm.

3

Verify 40-Character Fingerprint

Compare the spaced 40-character hexadecimal fingerprint against published security channels.

4

Inspect Subkeys and User IDs

Audit attached email identities, cryptographic subkey capabilities, and expiration timestamps.

Verification Decision Pathway

What operational objective are you verifying this key for?

Select an option below to reveal our recommended pathway.

5. Decoding Subkeys and Operational Flags

The PGP Key Viewer evaluates the capability flags embedded in each subkey's self-signature packet:

Certify [C] & Sign [S]

Certify: Allows the key to sign other user certificates and bind subkeys. Typically restricted to the primary key.
Sign: Authorizes the key to generate digital signatures on plain text files, emails, and Git release tags.

Encrypt [E] & Authenticate [A]

Encrypt: Authorizes the subkey to receive and decrypt session keys for secret communications (ECDH or RSA).
Authenticate: Enables the subkey to authenticate TLS connections or log into remote servers via SSH keys.

6. Practical Workflows: Identity Audits & Expired Keys

Incorporate client-side key inspection into everyday developer security routines:

Verifying Software Release Signatures

Before importing a software maintainer's public key to verify Linux packages or binary tarballs, paste their public key block into the viewer. Confirm that the displayed 40-character fingerprint matches the fingerprint published on the project's official HTTPS website or documentation.

Auditing Team Key Rollovers & Expirations

When team members update their PGP keys, inspect the new key block to verify that creation dates are current, that old expired subkeys have been renewed or rotated, and that email user IDs reflect corporate domains.

7. Common Mistakes & Key ID Collisions

1.
Uploading Private Secret Keys to Web Portals: Commercial online PGP utilities often transmit input text to remote servers. Pasting an ASCII-armored private key (BEGIN PGP PRIVATE KEY BLOCK) into an untrusted website exposes your secret key material to cloud operators.
2.
Trusting Truncated Key IDs: Verifying only the last 8 or 16 characters of a fingerprint leaves you vulnerable to spoofed keys distributed by impersonators on public keyservers.
3.
Ignoring Subkey Expiration: When an encryption subkey expires, senders attempting to encrypt files for you will encounter software errors, even if the master primary key remains valid.

8. Troubleshooting Corrupted ASCII Armor & Passphrases

The OpenPGP parser handles both ASCII-armored text blocks and binary OpenPGP packets. Follow these guidelines if a key fails to parse:

Troubleshooting Guidelines

  • • Malformed Armor Header or Checksum: Ensure the block begins with 5 hyphens (-----BEGIN PGP PUBLIC KEY BLOCK-----) and includes the trailing 5 hyphens on the closing tag. Stripping blank lines between the header and base64 body causes parsing rejections.
  • • Passphrase-Protected Secret Keys: The viewer decodes public packet metadata without needing a passphrase. If you paste a private key, the tool reads the unencrypted public packet headers (Key ID, fingerprint, algorithm) without asking for or decrypting the private key passphrase.
  • • Post-Quantum OpenPGP Drafts: Experimental post-quantum hybrid algorithm keys (such as ML-KEM combined with X25519) that have not been ratified in RFC 9580 may be reported as unknown algorithm packets.

9. Client-Side Cryptographic Isolation

Cryptographic keys protect critical communications, software distribution channels, and private credentials. Transmitting cryptographic keys to external web servers introduces severe supply-chain and surveillance risks.

The SHRTX PGP Key Viewer executes entirely client-side using OpenPGP.js inside your browser's isolated JavaScript sandbox. Key packets are parsed directly in volatile workstation memory. Zero network requests are initiated, zero key blocks are transmitted, and zero identity metadata is logged.

10. Pre-Flight Cryptographic Key Checklist

Verify these items before using or publishing an OpenPGP key:

OpenPGP Key Verification Checklist

Complete these checks before sharing or uploading your files.