PGP / GPG Key Lookup & Inspector
Find an OpenPGP public key by email, fingerprint, or 16-hex key ID. The lookup is proxied through this server (your IP is never forwarded) and the returned key is parsed in your browser to reveal user IDs, aliases, subkeys, capabilities, and the key timeline. Already have a key block? Decode it locally in the Inspect a key tab.
keys.openpgp.org, the email domain's WKD, keys.mailvelope.com, then keyserver.ubuntu.com. The browser never contacts those servers directly — the request is proxied server-side so your IP stays private. Parsing of the returned key happens locally in your browser. The Inspect a key tab never sends anything: a pasted key stays in your browser, and a pasted private key is refused.
Examples: alice@example.com · 3AA5C34371567BD2 (16-hex key ID) · 1A09 1C12 ... full 40-char fingerprint. Spaces / colons / leading 0x are ignored.
What you get
- All user IDs on the key — real name, email, and comment parsed out separately. A single PGP key often carries several aliases (work email + personal email + handle).
- Fingerprint & long key ID for the primary key and every subkey.
- Algorithm (RSA bit length, curve name for ECC) and key flags: certify, sign, encrypt, authenticate.
- Timeline — creation date and expiration for the primary key and each subkey, so you can see when subkeys were rotated.
- Source provenance — which keyserver answered, plus the trace of which servers were tried.
Important caveats
- A fingerprint match does not establish identity. Always confirm the fingerprint with the owner via a separate trusted channel.
keys.openpgp.orgonly publishes user IDs whose email was verified through a confirmation message; some keys appear with no user IDs there.keyserver.ubuntu.comdoes not verify emails — anyone could have uploaded a UID claiming any address.- Keyservers expose creation and expiration, not the full signature graph. For Web-of-Trust analysis use
gpg --recv-keysandgpg --check-sigslocally. - Short 8-hex key IDs are not accepted — they are collidable. Use the 16-hex long form or the full fingerprint.
Full guide: how to find, verify and publish a PGP key, with the four key sources compared and the WKD setup for your own domain.
Begins with -----BEGIN PGP PUBLIC KEY BLOCK-----. You can export one with gpg --armor --export <keyid>.
What you get
- Fingerprint & Key ID for the master key and all subkeys. A v4 fingerprint is SHA-1 (RFC 4880 §5.5.4) and its key ID is the last 16 hex characters; a v6 fingerprint is SHA-256 (RFC 9580 §5.5.4) and its key ID is the first 16. v5 (LibrePGP) is also SHA-256. v3 keys use MD5, which this in-browser tool does not compute — it shows the key ID only.
- Algorithm and key size when the algorithm is RSA / DSA / ElGamal, or curve name for ECC keys.
- Creation date from the public-key packet, and expiration read from the self-signature’s key-expiration subpacket (RFC 4880 §5.2.3.6) — expiry lives in the self-signature, not the key packet.
- Key flags per subkey: certify, sign, encrypt (communications & storage), authenticate.
- User IDs on the key, with the date of each self-signature and which one is marked primary.
Important caveats
- This tool does not verify signatures or build a web of trust — it only describes packet structure.
- Trust before encrypting: confirm the fingerprint with the recipient via a separate channel.
- For full verification use
gpg --import key.ascfollowed bygpg --check-sigs.
How to inspect a PGP key
- Export the key you want to check, for example
gpg --armor --export alice@example.org > alice.asc, or copy it from the sender’s website or email signature. - Paste the whole block, from
-----BEGIN PGP PUBLIC KEY BLOCK-----to theENDline, into the box above. Armor headers such asComment:are fine. - Press Inspect. The key is decoded in your browser; nothing is sent to a server.
- Read the three cards: master key, user IDs, subkeys. If you do not have the key yet, find it first in the Look up a key tab.
Reading the results
Master public key. The version (v4 is the common case; v6 is the newer RFC 9580 format), the algorithm, for example RSA 4096 bits or EdDSA (legacy) / Ed25519 (legacy), the creation and expiry dates, and the fingerprint. A v4 fingerprint is 40 hex characters, such as A1B2 C3D4 E5F6 0718 293A 4B5C 6D7E 8F90 1A2B 3C4D; the key ID is its last 16 characters. This fingerprint is the value to compare with the owner.
Expires. An EXPIRED marker means the owner has not extended the key. Most OpenPGP software will not encrypt to it. Ask the owner for a refreshed copy rather than ignoring the warning.
Subkeys. Modern keys keep the master key for certification only and use subkeys for daily work: typically one Sign subkey and one Encrypt subkey. Mail to this person is encrypted to the subkey that carries the Encrypt flag. RSA below 2048 bits and a v3 key (marked DEPRECATED) are reasons to ask for a new key.
For the full workflow of finding, verifying and publishing keys, see the PGP keys guide.
Frequently asked questions
Can I look up a PGP key without installing GnuPG?
Yes. Type the email address, fingerprint or long key ID above: the key is fetched from the public sources and decoded in your browser, with its user IDs, subkeys, capabilities and expiry dates. Use the Copy button to take the armored key with you.
Why is no key found for an email address?
Either the person never published a key, or it is published somewhere this lookup does not reach. keys.openpgp.org hides an address until its owner confirms it, so an unconfirmed key is only found by fingerprint. Ask the person for their fingerprint or key file.
The sources return different keys. Which one should I trust?
Prefer the key published through WKD (by the mail domain itself), then keys.openpgp.org or keys.mailvelope.com, which confirm addresses. keyserver.ubuntu.com accepts any upload. In every case, confirm the fingerprint with the owner before relying on it. See how to verify a PGP key.
Do the keyservers see my IP address?
No. The lookup goes through this server, so keyservers and mail domains see a request from cyberramen.com, not from you. They do see the address or fingerprint you searched for, because that is the query.
How do I import the key into GnuPG or Thunderbird?
Copy the armored key into a file and run gpg --import key.asc, or import the file in Thunderbird (Account settings → End-to-end encryption → OpenPGP Key Manager → File → Import). With GnuPG you can also fetch it directly: gpg --locate-keys alice@example.org.
How do I view the details of a PGP public key?
Open the Inspect a key tab, paste the armored block and press Inspect. On the command line the equivalent is gpg --show-keys key.asc, which lists the key without importing it into your keyring.
How do I find the fingerprint of a PGP key?
The Inspect tab shows it on the first card, grouped in blocks of four for a v4 key. With GnuPG, run gpg --fingerprint alice@example.org for an imported key. Compare all 40 characters, not just the last 8 or 16.
Is it safe to paste a PGP public key here?
Yes. A public key is meant to be shared, and this page decodes it in your browser without sending it anywhere. Never paste a private key into any web tool; this one refuses to parse a private key block.
What do the letters C, S, E and A mean on a PGP key?
They are key flags: C certify (sign other keys and user IDs), S sign data, E encrypt, A authenticate (for example SSH login). GnuPG prints them as [SC], [E] and so on.