Popular tools

Theme

PGP Key Generator

Make a PGP key pair for email, Git commit signing or file transfer. It's generated in your browser and never leaves it.

OpenPGP, RFC 9580 · 9 apps and services checked in their own docs and code · made in your browser

UseEach one sets the key type and expiry below.

Key type

Recommended. The default in GnuPG, Proton Mail and Sequoia, and every app in the table takes it. K21K43K46

Expires

Expires on 2029-10-31. 3 years is GnuPG's, Thunderbird's and Sequoia's default. While you hold the key you can move the date. K22K37K46G16

Opening the sealed panel…

Need a passphrase? The Password Generator makes a long one in your browser.

ExampleA made-up key for Ada Lovelace <ada@example.com>. Generate yours to replace it.

Your public key

Share this one: people use it to encrypt to you and to check your signatures. It starts with -----BEGIN PGP PUBLIC KEY BLOCK-----.

-----BEGIN PGP PUBLIC KEY BLOCK-----

xjMEauWuEBYJKwYBBAHaRw8BAQdAwqdyYNp8UcpUWg5YUJUECHnyjHkR2YAFLVOU
DdgKUCXNHkFkYSBMb3ZlbGFjZSA8YWRhQGV4YW1wbGUuY29tPsKQBBMWCgBCBYJq
5a4QApsDBYkFpOwAAwsJBwMVCggDFgIAAh4BAhkBFiEEKqgOwwupxgm99UgD3Si5
YZZ3XpIJEN0ouWGWd16SAAAVJwEA9Uikc/LLwXJB2boOrYfN9nQeCGZYLLwNSuRc
YmZEH4YA/R4GaCYPnyKB3zfTn8Ulua+gtd/bN249QetN+9ovki8HzjgEauWuEBIK
KwYBBAGXVQEFAQEHQDtFzFPV2dFISflgWWYVW9zDL2VUf7bl/8TXFxzl5rJZAwEI
B8J+BBgWCgAwBYJq5a4QApsMBYkFpOwAFiEEKqgOwwupxgm99UgD3Si5YZZ3XpIJ
EN0ouWGWd16SAAA+MwEAv8mIPPRwJGmP+8wZFbjVL+BiiB/O4EEYknxGcR2WbbsA
/2pzXLmH7nOBCVSrkyJ+sFQbhw98T31yYphwMzQFmnsP
=om6i
-----END PGP PUBLIC KEY BLOCK-----

13 lines

Fingerprint

2AA8 0EC3 0BA9 C609 BDF5 4803 DD28 B961 9677 5E92

40 hex digits: the SHA-1 of the primary key. Compare all of it when you check a key.

Long key ID
DD28B96196775E92
16 hex digits, the ID Git and gpg use. Two keys can share an ID: the fingerprint is what proves it's yours.
Short key ID
96775E92
8 digits: too short to identify a key on its own.
Encryption subkey
82907BD6704BBEBF
Created
2026-10-31
Expires
2029-10-31
Private key protection
AES-256, passphrase stretched by Iterated and Salted S2K (SHA-256): GnuPG and Thunderbird read it

Generated in your browser, in a sealed frame whose policy blocks every network request. Nothing is uploaded.

Why a sealed frame

The passphrase, the private key and the revocation certificate are made and kept in a separate frame with its own origin. Its security policy blocks every network request, so this page's code in it can only hand the files to your browser's downloads, and the page's own scripts can't read into it. The page receives the public key alone. A browser extension you've allowed to read every site can still see into the frame, as it can into any page.

Will it work in…?

For the Ed25519 key you pickedWorks in 6 of 9

  • GnuPG 2.4 · 2.5
  • Gpg4win (Kleopatra)
  • GPG Suite (macOS)
  • Thunderbird
  • Proton Mail
  • keys.openpgp.org
  • GitHub
  • Sequoia (sq)
  • OpenKeychain (Android)

Each answer comes from the app's own documentation or source code. Open a fact to see the source.

AppCheckedThis keyWhy
GnuPG 2.42.4.9; end of life 2026-06-30WorksGnuPG's default key type since 2.3.0. Versions before 2.4.7 need the armor checksum, which this page keeps on v4 keys. K21K28K7
GnuPG 2.52.5.24, the stable releaseWorksGnuPG's default key type. K21
Gpg4win (Kleopatra)5.1.1 with GnuPG 2.5.24WorksRuns GnuPG 2.5.24, whose default key type this is. K31K21
GPG Suite (macOS)2023.3 with GnuPG 2.2.41, its newest releaseWorksGnuPG 2.2 reads Ed25519 and Curve25519 keys (since 2.1.7). K32G22
Thunderbird159 (RNP 0.18.1) and ESR 140 (RNP 0.17.1)WorksIts own ECC option makes this exact key type: EdDSA with a Curve25519 encryption subkey. K37K36
Proton Mailhelp pages and web client codeDoesn't workWith your settings: Proton rejects a key with an expiry date: pick No expiry. K39
keys.openpgp.orgthe keyserver Thunderbird, GPG Suite and OpenKeychain use by defaultSee the noteWith your settings: With no email in the user ID only the key's technical data is published: it can be found by fingerprint, not by address. K57K58G32
GitHubGitHub DocsDoesn't workWith your settings: GitHub verifies commits only from a key whose email is a verified address on your account. K62G27
Sequoia (sq)sq 1.5 on sequoia-openpgp 2Workssq's own default key (Cv25519, RFC 4880 profile). K46
OpenKeychain (Android)6.0.4 (Android); no longer actively developedWorksIts default key since 6.0.0: EdDSA with a Curve25519 encryption subkey. K56G35

Next steps

A made-up key for Ada Lovelace <ada@example.com>. Generate yours to replace it.

GnuPG

  1. Import

    gpg --import ada-lovelace-dd28b96196775e92-secret.asc

    Adds the private key to your keyring, with the public key it contains. G13G40

  2. Check

    gpg --list-secret-keys --keyid-format=long 2AA80EC30BA9C609BDF54803DD28B96196775E92

    The fingerprint it lists must match the one above, digit for digit. G14G5

  3. Trust

    gpg --edit-key 2AA80EC30BA9C609BDF54803DD28B96196775E92 trust

    Answer 5 (I trust ultimately), then type quit. gpg trusts a key that way only when it made the key itself. G15

  4. Export

    gpg --armor --export 2AA80EC30BA9C609BDF54803DD28B96196775E92 > ada-lovelace-dd28b96196775e92-public.asc

    Writes the public key out again whenever you need to share it. G18

  5. Extend

    gpg --quick-set-expire 2AA80EC30BA9C609BDF54803DD28B96196775E92 2y && gpg --quick-set-expire 2AA80EC30BA9C609BDF54803DD28B96196775E92 2y '*'

    Sets a new expiry on the key, then on its subkey. Share the updated public key afterwards. G16

  6. Revoke

    gpg --import ada-lovelace-dd28b96196775e92-revocation.asc

    First delete the colon before -----BEGIN in the file. Then publish the revoked key: a revocation can't be taken back. K30G17

PGP Key Generator: an Ed25519 key for Ada Lovelace made in the browser, its packets drawn in the navy column and the apps that accept itPGP Key Generator: an Ed25519 key for Ada Lovelace made in the browser, its packets drawn in the navy column and the apps that accept itPick a useEmail, Git commit signing, Proton Mail or a file-transfer partner: each sets the key type and the expiry it needs.Your user IDName and email, written into the key as Name <email>. Nothing you type is sent or stored.A sealed frameThe passphrase, the private key and the revocation certificate exist only in this panel, whose security policy blocks every network request.This keyThe key's packets in order, each with its real size: the primary key, your user ID, the signatures and the subkey.Will it work in…?GnuPG, Thunderbird, Proton Mail, GitHub and more, each answer linked to the app's own documentation or code.
A made-up key for Ada Lovelace: made in a sealed frame in the browser, its packets taken apart, and where it works.

What is a PGP key? Inside the public key block

A PGP key is a key pair in the OpenPGP format: a public key you share and a private key you keep. When you generate a PGP key you get both, each made of packets: the primary key, your user ID, a signature that ties them, and a subkey for encryption. As text, the public half is a PGP public key block, starting with -----BEGIN PGP PUBLIC KEY BLOCK-----.

By convention the primary key certifies and signs, and a separate subkey encrypts. The self-signature on your user ID holds the key's flags, its expiry and the ciphers it prefers. The fingerprint is a hash of the primary key packet: 40 hex digits for a v4 key, 64 for v6. A key ID is only a slice of it, and two keys can share one, so check the whole fingerprint.

The private key file has the same packets with the secret numbers added, encrypted under your passphrase, so it contains the public key too. Share only the public key block. Its last line before the tail is a checksum that RFC 9580 discourages, kept on v4 keys because some GnuPG versions fail without it.

Armorada-lovelace-dd28b96196775e92-public.asc

Armor header line

-----BEGIN PGP PUBLIC KEY BLOCK-----

The packets, base64

xjMEauWuEBYJKwYBBAHaRw8BAQdAwqdyYNp8UcpUWg5YUJUECHnyjHkR2YAFLVOUDdgKUCXNHkFkYSBMb3ZlbGFjZSA8YWRhQGV4YW1wbGUuY29tPsKQBBMWCgBCBYJq5a4QApsDBYkFpOwAAwsJBwMVCggDFgIAAh4BAhkBFiEEKqgOwwupxgm99UgD3Si5YZZ3XpIJEN0ouWGWd16SAAAVJwEA9Uikc/LLwXJB2boOrYfN9nQeCGZYLLwNSuRcYmZEH4YA/R4GaCYPnyKB3zfTn8Ulua+gtd/bN249QetN+9ovki8HzjgEauWuEBIKKwYBBAGXVQEFAQEHQDtFzFPV2dFISflgWWYVW9zDL2VUf7bl/8TXFxzl5rJZAwEIB8J+BBgWCgAwBYJq5a4QApsMBYkFpOwAFiEEKqgOwwupxgm99UgD3Si5YZZ3XpIJEN0ouWGWd16SAAA+MwEAv8mIPPRwJGmP+8wZFbjVL+BiiB/O4EEYknxGcR2WbbsA/2pzXLmH7nOBCVSrkyJ+sFQbhw98T31yYphwMzQFmnsP

Checksum (CRC24)

=om6i

Armor tail

-----END PGP PUBLIC KEY BLOCK-----

Packets417 bytes

  1. Primary key53 bytes

    version
    4
    created
    2026-10-31
    algorithm
    EdDSALegacy (22)
    public key
    C2A77260…D80A5025 · 32 bytes

    fingerprint = SHA-1 of this packet

    2AA80EC30BA9C609BDF54803DD28B96196775E92

    key ID = its last 16 hex digits: DD28B96196775E92

  2. User ID32 bytes

    User ID
    Ada Lovelace <ada@example.com>

  3. Self-signature146 bytes

    flags
    Certify, Sign
    expiry
    2029-10-31
    preferences
    AES-256, AES-128 · SHA2-512, SHA2-256 · ZLIB, Uncompressed
    issuer
    DD28B96196775E92

  4. Subkey58 bytes

    version
    4
    created
    2026-10-31
    algorithm
    ECDH (18)

  5. Binding signature128 bytes

    flags
    Encrypt communications, Encrypt storage
    expiry
    2029-10-31
    issuer
    DD28B96196775E92
The public key block of a made-up key for Ada Lovelace <ada@example.com>, generated by this page's engine: the armor, then each packet with its real size.

G1G2G3G4K14K17K19K2G5G40K7K28

Ed25519 or RSA: which key type?

Choose Ed25519 unless someone asks you for RSA. It's been GnuPG's default since 2.3.0, it's Proton Mail's and Sequoia's default too, every app in our table takes it, and its keys and signatures are a small fraction of RSA's size. RSA 3072 and 4096 are for older software and partners who require RSA.

Both are strong today: Ed25519 is designed for about the 128-bit security level, the level NIST gives RSA 3072. RSA 4096 is more work to break but stays below NIST's next level, which needs 7,680 bits, and its keys, signatures and generation are bigger and slower. RFC 9580 deprecates RSA and forbids generating it below 3072 bits, which is why this page offers nothing smaller.

Public key

  • Ed25519417 bytes
  • RSA 30721,744 bytes
  • RSA 40962,256 bytes

Signature

  • Ed2551964 bytes
  • RSA 3072384 bytes
  • RSA 4096512 bytes

Time to generate

  • Ed255190.6 ms
  • RSA 3072276 ms
  • RSA 4096547 ms

Security level

  • Ed25519128-bit
  • RSA 3072128-bit
  • RSA 4096128-bit
The example key made three ways by this page's engine. Sizes are exact; generation times were measured in Chromium 156 on an Apple M4 Mac (median of five runs; Ed25519 of forty).

K21K43K46K56G11G12K6G6

What's the difference between v4 and v6 keys?

A v6 key is the new format from RFC 9580 (2024): Ed25519 and X25519 keys, a SHA-256 fingerprint, and Argon2 with AEAD to protect the private key. It's what the RFC asks software to create, but GnuPG, Thunderbird and keys.openpgp.org can't use one yet, so this page makes v4 keys unless you pick v6.

GnuPG 2.4, and 2.5 up to 2.5.22, refuse a v6 key outright; 2.5.23 and later accept its algorithms only with --allow-9980, an option GnuPG's own manual doesn't suggest. Thunderbird builds its OpenPGP library without v6 support, and keys.openpgp.org fails to parse a v6 upload. Sequoia, OpenPGP.js and Proton's GopenPGP read and make v6 keys, and Proton Mail accepts v6 imports only after you opt in to its post-quantum keys.

Our v4 keys also tell senders they read only the older message format, SEIPD v1. A v4 key that announced v2 would invite apps like Sequoia to send messages that GnuPG up to 2.5.22 and Thunderbird can't open. And this page never puts the new Ed25519 inside a v4 key: RFC 9580 allows it, but GnuPG and Thunderbird can't use that either.

v4 key

Fingerprint
SHA-1, 40 hex digits
2AA8 0EC3 0BA9 C609 BDF5 4803 DD28 B961 9677 5E92
Private key
Iterated and Salted S2K + AES-256

v6 key

Fingerprint
SHA-256, 64 hex digits
BFA7 91BE BFFC BABF 3830 FCB1 A29B A9EA 6F93 9A82 CDC3 73F6 93C8 A530 A6DC 946F
Private key
Argon2id + AES-256-OCB
v4 keyv6 key
Ed25519RSAEd25519 (v6)
GnuPG 2.4worksworksdoesn't
GnuPG 2.5worksworksdoesn't
Gpg4win (Kleopatra)worksworksdoesn't
GPG Suite (macOS)worksworksdoesn't
Thunderbirdworksworksdoesn't
Proton Mailworksworksnot documented, or a condition
keys.openpgp.orgworksworksdoesn't
GitHubworksworksnot documented, or a condition
Sequoia (sq)worksworksworks
OpenKeychain (Android)worksworksnot documented, or a condition
  • works
  • doesn't
  • not documented, or a condition
What each app does with each key type this page makes, from its own documentation or source code. The table above the guide links every source.

K1K3K2K9K10K11K23K24K25K34K38K59K45K49K50K54K44K16K27K35K47K5

Should a PGP key expire? Expiry and the revocation certificate

Yes: set an expiry and keep the revocation certificate. An expiry retires a key you've lost track of, and while you hold the private key you can move the date at any time and share the updated public key. The revocation certificate retires the key early, at once, if it's lost or stolen.

Three years is the default here, as in GnuPG, Thunderbird and Sequoia. GitHub's own guide suggests a key that never expires, but GitHub keeps commits it verified before a key expired verified, and you can add expired keys. Proton Mail rejects a key with any expiry, so its use case sets none.

This page makes the revocation certificate with the key, as GnuPG does, with a colon before its first line so it can't be imported by accident. To use it, delete the colon, import the file with gpg --import and publish the revoked key. Store it apart from the private key: anyone holding it can revoke your key, and a published revocation can't be undone.

Created2026-10-31today

Expires2029-10-31+3 years

New expiry2031-10-31+2 years

RevokedRevoke: import the revocation certificate

Key lost: the expiry retires it

Extend: gpg --quick-set-expire

  1. Created2026-10-31today
  2. RevokedRevoke: import the revocation certificate
  3. Expires2029-10-31+3 yearsKey lost: the expiry retires it
  4. New expiry2031-10-31+2 yearsExtend: gpg --quick-set-expire

No expiry: valid until revoked

The example key's life: made today, set to expire in three years, extended before it does, or revoked at once with its certificate.

K15G16K20K30K22K37K46K61K62K39G17G21

How does the passphrase protect the private key?

The passphrase is stretched into an AES-256 key that encrypts the secret part of the file. A v4 key uses Iterated and Salted S2K with SHA-256, the method GnuPG and Thunderbird read. A v6 key uses Argon2id with 64 MiB of memory and AES-256 in OCB mode, which RFC 9580 recommends.

The salt is random for every key, so the same passphrase gives a different file each time, and the iteration count, or Argon2's memory, makes every guess cost an attacker work. None of it rescues a short passphrase: a long, random one is what protects the file. Make one with our Password Generator. There's no recovery if you forget it, and with No passphrase the file holds the key in the clear.

v4 keyGnuPG and Thunderbird read it

  1. Your passphrase
  2. Salt (random)9896 59D3 F963 ED0D8 bytes
  3. Iterated and Salted S2K, SHA-25616,777,216 bytes hashed
  4. AES-256 key
  5. AES-256, CFB modeSHA-1 checksum
  6. Encrypted secret key54 bytes

v6 keyRFC 9580's recommendation

  1. Your passphrase
  2. Salt (random)7E5D 5766 82B9 DDF0 76BA 0EA7 E5C7 13CE16 bytes
  3. Argon2id3 passes · 4 lanes · 64 MiB
  4. HKDF-SHA256
  5. AES-256 key
  6. AES-256, OCB modeauthentication tag
  7. Encrypted secret key48 bytes
How the example key's private part is locked, for a v4 and a v6 key: the salt and the counts are the ones in its file.

K8K9K10K11K12K13K26K36G42G20

How do I import the key into GnuPG, Thunderbird or Proton Mail?

Import the private key file: it holds the public key too. In GnuPG, gpg --import the file. In Thunderbird, use Account Settings → End-To-End Encryption → Add Key… → Import an existing OpenPGP Key. In Proton Mail, use Settings → All settings → Encryption and Keys → Email encryption keys → Import key.

After the gpg import key step, check the fingerprint with gpg --list-secret-keys --keyid-format=long and tell gpg the key is yours: gpg --edit-key, then trust and 5 (ultimate). gpg trusts a key that way only when it made the key itself. Kleopatra (Gpg4win) and GPG Suite run GnuPG underneath, so a key imported there lands in the same keyring.

Thunderbird asks you to select the imported key for the account afterwards. Proton asks for the key's passphrase and takes it only with no expiry and one user ID with your Proton address: the Proton Mail import use case sets both. Give other people only the public key.

The private key fileada-lovelace-dd28b96196775e92-secret.asc

GnuPG

  1. gpg --import ada-lovelace-dd28b96196775e92-secret.asc
  2. Check the fingerprint
  3. trust → 5

Thunderbird

  1. Account Settings
  2. End-To-End Encryption
  3. Add Key…
  4. Import an existing OpenPGP Key

Proton Mail

  1. Settings → All settings
  2. Encryption and Keys
  3. Email encryption keys
  4. Import key

asks for the passphrase

Where the private key file goes in each app, from each app's own documentation and interface text.

G13G40G14G15G30G31K31K32K39K40

How do I add a GPG key to GitHub and sign commits?

Import the private key into GnuPG, point Git at its long key ID with git config --global user.signingkey, switch on commit.gpgsign, then paste the public key at GitHub → Settings → SSH and GPG keys → New GPG key. The key's email must be a verified address on your GitHub account, and the one Git commits with.

A GitHub GPG key is an ordinary OpenPGP public key: GitHub lists EdDSA and RSA among the algorithms it supports, so the default Ed25519 key works. It doesn't mention v6 keys, so don't use one for Git. Signing needs the private key in GnuPG; the public key on GitHub is what it checks each signed commit against, and a commit it verified stays verified after the key expires.

Your computer

  1. Private key in GnuPGed25519/DD28B96196775E92
  2. Git's configgit config --global user.signingkey DD28B96196775E92
  3. git commit -SSigned commit

GitHub

  1. Your public key, added in Settings-----BEGIN PGP PUBLIC KEY BLOCK-----
  2. Email is a verified addressada@example.com
  3. Signature matches the keyDD28B96196775E92

Verified

The example key's long ID in Git's config, and what GitHub checks on each signed commit.

G13G25G26G27G28G29K61K62

How do I publish my public key?

Upload the public key to keys.openpgp.org and confirm the email it sends: until you do, it publishes the key but not your address. On your own domain, serve it by Web Key Directory (WKD) at a fixed address or as an OPENPGPKEY record in DNS, and point security.txt's Encryption: field at it.

WKD's file name is the SHA-1 of the part before the @, in z-base-32, and GnuPG looks there by default when you encrypt to an address it has no key for. The server must send the binary key, not the armored text, plus a policy file. The DNS record's name is the SHA-256 of the same part, cut to 28 bytes, under _openpgpkey; check it with our DNS Lookup. WKD is still an Internet-Draft, and OPENPGPKEY an experimental RFC.

Thunderbird, GPG Suite and OpenKeychain look keys up on keys.openpgp.org by default, and it lets you remove your address later. Older keyservers can't delete a key once it reaches them, so publish only the public key, and only when you're sure.

Ada Lovelace <ada@example.com>ada-lovelace-dd28b96196775e92-public.asc

  • keys.openpgp.org

    https://keys.openpgp.org/upload

    after you confirm the email

  • DNS OPENPGPKEYbinary key

    fdee430d40bd57deeac186cd9790033d0f06f909a8806e7ce6e717ab._openpgpkey.example.com

    SHA-256 of “ada”, first 28 bytes

  • WKD, advancedbinary key

    https://openpgpkey.example.com/.well-known/openpgpkey/example.com/hu/huin1uygftjfco69ypidm11zuqef9jyy?l=ada

    SHA-1 of “ada”, z-base-32

  • WKD, directbinary key

    https://example.com/.well-known/openpgpkey/hu/huin1uygftjfco69ypidm11zuqef9jyy?l=ada

    SHA-1 of “ada”, z-base-32

  • security.txt

    Encryption: https://example.com/pgp-key.txt

    a link, never the key

Where the example address ada@example.com's key would go, with the names this page's engine computes.

K57K58G32G41K63K64G19G33G34K60

PGP key FAQ

Is it safe to generate a PGP key online?

It depends on where the key is made. This page makes it in your browser, inside a sealed frame whose security policy blocks every network request, so this page's code has no way to send the private key, its passphrase or the revocation certificate anywhere. The page around the frame only receives the public key. You can check the frame's policy in your browser's developer tools. Browser extensions allowed to read every site can still see into it, as into any page; for a key that guards something valuable, GnuPG on an offline computer is stricter still.

What's the difference between PGP and GPG?

PGP (Pretty Good Privacy) is the program Philip Zimmermann first released in 1991. OpenPGP is the open standard that grew out of it, now RFC 9580. GnuPG, also called GPG, is a free command-line program that implements OpenPGP. A "GPG key" and a "PGP key" are the same thing: an OpenPGP key. The keys this page makes import into GnuPG and other OpenPGP apps.

Which key type should I choose?

Ed25519, unless someone asks for RSA. It's the default in GnuPG, Proton Mail, Sequoia and OpenKeychain, every app in the table accepts it, and its keys and signatures are small. Pick RSA 3072 or 4096 for older software or a partner who requires RSA: RFC 9580 forbids generating anything below 3072 bits. The v6 key suits Sequoia and OpenPGP.js users today; GnuPG, Thunderbird and keys.openpgp.org can't use it yet.

How long should my PGP key last?

Three years is GnuPG's, Thunderbird's and Sequoia's default, and this page's. An expiry isn't a deadline you're stuck with: as long as you hold the private key, you can move it with gpg --quick-set-expire and share the updated public key. If you lose the key, the expiry retires it for you. Proton Mail is the exception: it rejects keys that expire, so pick No expiry for it.

What do I do with the revocation certificate?

Keep it offline and apart from the private key, on a USB stick or printed. If the key is lost or stolen, or you forget its passphrase, open the file, delete the colon before -----BEGIN, run gpg --import on it and publish the revoked key. Anyone holding the file can revoke your key, and a published revocation can't be taken back, so guard it like the key.

I forgot my passphrase: can I recover the key?

No. The passphrase encrypts the private key file, and there is no copy or back door: this page keeps nothing once you leave it. Without the passphrase the key can't sign or decrypt anything. Revoke it with the revocation certificate, publish the revocation, and make a new key pair. Messages encrypted to the old key stay unreadable, so pick a passphrase you can't lose, and store it in a password manager.

Why won't Proton Mail import my key?

Proton Mail imports a key only if it has no expiration date, exactly one user ID with your Proton address, a subkey that can encrypt, and AES-256, SHA-256 and ZLIB in its preferences. Every key from this page has the last two. Pick the Proton Mail import use case and type your Proton address to get the first two, then import it under Settings → All settings → Encryption and Keys → Email encryption keys.

How do I fix "gpg: signing failed: No secret key"?

gpg says this when it has no private key for the key ID Git asked for: a public key alone can't sign. Import the private key with gpg --import, then run gpg --list-secret-keys --keyid-format=long and copy the 16-digit ID from the sec line. Set it with git config --global user.signingkey, and check there's no typo in the ID or an old key's ID left in Git's config.

Missing something?Suggest a feature or a new tool

Related tools