# PGP key inspector

- Human page: https://happytails.ai/en/developer-tools/pgp-key-inspector/
- Markdown: https://happytails.ai/en/developer-tools/pgp-key-inspector.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/pgp-key-inspector/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `pgp-key-inspector` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

Runs in your browser with no key server lookups. Up to 20 armored public keys in 200000 characters.

### Inputs and settings

Text input: Public key.

Example or placeholder shown in the interface (not a validated fixture):

```text
-----BEGIN PGP PUBLIC KEY BLOCK-----
```

Paste the armored public key, never the private key. Up to 200,000 characters. Review the settings before running.

| Setting | Meaning | Control type | Default | Constraints |
| --- | --- | --- | --- | --- |
| `time` | Check expiry at (UTC or Unix seconds) | text | "2026-10-16T12:00:00Z" |  |

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

Up to 20 keys and 2000 packets in total, across all pasted blocks, in 200000 characters. Parsing and signature checks run locally in a background worker in your browser. Download a JSON report and a CSV file of keys and subkeys.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "pgp-key-inspector",
  "category": "developer-tools",
  "built": true,
  "requirements": "Up to 20 keys and 2000 packets in total, across all pasted blocks, in 200000 characters. Parsing and signature checks run locally in a background worker in your browser. Download a JSON report and a CSV file of keys and subkeys.",
  "implementation": {
    "fields": [
      {
        "key": "time",
        "label": "Check expiry at (UTC or Unix seconds)",
        "value": "2026-10-16T12:00:00Z",
        "type": "text"
      }
    ],
    "registrationFamily": "crypto-formats-key-material",
    "inputMaxLength": 200000,
    "inputErrorCode": "CRYPTO_FORMATS_KEY_MATERIAL_TOO_LONG_PGP",
    "note": "Runs in your browser with no key server lookups. Up to 20 armored public keys in 200000 characters.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 200000,
      "inputMode": "text",
      "label": "Public key",
      "placeholder": "-----BEGIN PGP PUBLIC KEY BLOCK-----",
      "help": "Paste the armored public key, never the private key. Up to 200,000 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Inspect an OpenPGP public key in your browser: fingerprints, user IDs, subkeys, capabilities and expiry, with every self-signature verified. Nothing is uploaded or looked up on a key server.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

### How to use PGP key inspector

1. Paste one or more armored public keys, as exported by gpg --armor --export.
2. Enter the time to check expiry against.
3. Run the tool and compare the fingerprint with the one the key owner gave you.
4. Download the JSON report or the CSV list of keys and subkeys.

## Useful next steps

- [File hash](https://happytails.ai/en/developer-tools/file-hash/) ([Markdown](https://happytails.ai/en/developer-tools/file-hash.md))

- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))

- [RSA key generator](https://happytails.ai/en/developer-tools/rsa-key-generator/) ([Markdown](https://happytails.ai/en/developer-tools/rsa-key-generator.md))

## Fingerprints

Following RFC 9580 (July 2024), version 4 fingerprints are SHA-1 over the key packet and version 6 fingerprints are SHA-256. The key ID is the last 8 bytes for version 4 and the first 8 bytes for version 6. The armor checksum is checked when present.

### Self-signatures

User ID certifications, direct key signatures and subkey bindings are verified for RSA, ECDSA on NIST curves, Ed25519 and legacy EdDSA keys. Expiry and capabilities are only taken from self-signatures that verify, and revocations are applied. A subkey never outlives its primary key: its expiry is the earlier of its own binding date and the primary key expiry, as GnuPG also treats every subkey of an expired primary key as expired. The report keeps the binding date as bindingExpires. Third party certifications are not checked.

### Limits

A self-signature proves what the key holder claims, not who they are. Compare the fingerprint over a trusted channel. Secret key blocks are refused, and version 3 and version 5 keys are listed without fingerprints.