PGP key inspector
Inspect an OpenPGP public key in your browser: fingerprints, user IDs, subkeys, capabilities and expiry, with every self-signature verified. Nothing is uploaded or looked up on a key server.
Up to 20 keys and 2000 packets in total, across all pasted blocks, in 200000 characters. Parsing and signature checks run locally in a background worker in your browser. Download a JSON report and a CSV file of keys and subkeys. Paste the armored public key, never the private key. Up to 200,000 characters. Review the settings before running.
Your result
How to use PGP key inspector
- Paste one or more armored public keys, as exported by gpg --armor --export.
- Enter the time to check expiry against.
- Run the tool and compare the fingerprint with the one the key owner gave you.
- Download the JSON report or the CSV list of keys and subkeys.
Useful next steps
Fingerprints
Following RFC 9580 (July 2024), version 4 fingerprints are SHA-1 over the key packet and version 6 fingerprints are SHA-256. The key ID is the last 8 bytes for version 4 and the first 8 bytes for version 6. The armor checksum is checked when present.
Self-signatures
User ID certifications, direct key signatures and subkey bindings are verified for RSA, ECDSA on NIST curves, Ed25519 and legacy EdDSA keys. Expiry and capabilities are only taken from self-signatures that verify, and revocations are applied. A subkey never outlives its primary key: its expiry is the earlier of its own binding date and the primary key expiry, as GnuPG also treats every subkey of an expired primary key as expired. The report keeps the binding date as bindingExpires. Third party certifications are not checked.
Limits
A self-signature proves what the key holder claims, not who they are. Compare the fingerprint over a trusted channel. Secret key blocks are refused, and version 3 and version 5 keys are listed without fingerprints.