PGP Keys — find, verify and publish an OpenPGP key

Encrypting to the wrong key is worse than not encrypting at all: the message is sealed, but for someone else. Finding a PGP key is easy. Being sure it belongs to the person you mean takes one more step. This page covers where public keys live, how to check you have the right one, and how to publish your own so others can find it.

The workflow

1. PGP Key Lookup — Start here with an email address, fingerprint or key ID. It asks keys.openpgp.org, the domain's own Web Key Directory, Mailvelope and keyserver.ubuntu.com, and with "Compare every source" flags any source that holds a different key for the same address.
2. PGP Key Inspector (Inspect tab) — Someone sent you a key block in an email or a chat, or you want the packet-level detail: paste the armored key to see every user ID, subkey, algorithm, expiry and revocation, parsed locally in your browser.
3. SSH Key Analyzer — Many people sign in with the same key family they sign mail with. Check an SSH public key's type, size and fingerprint the same way before adding it to authorized_keys.

Where public keys live

There is no single directory of PGP keys. Four places cover almost every key in use today, and they do not offer the same guarantees:

When the sources disagree, trust them in that order. The lookup tool's Compare every source option shows, source by source, whether each one holds the same key.

How to verify someone's PGP key

1. Look the key up by email with the PGP Key Lookup, or with gpg --locate-keys alice@example.org.
2. Check that it is still usable. It must not be expired or revoked, and it needs an encryption-capable subkey (the E flag). The lookup shows all three.
3. Get the fingerprint from the owner through a channel an attacker is unlikely to control at the same time: in person, a video call, a signed release note, an email signature you have seen for years, or their official website over HTTPS.
4. Compare the full fingerprint, all 40 (v4) or 64 (v6) hex characters, never only the key ID. Locally, gpg --fingerprint alice@example.org prints it grouped in fours for easy reading.
5. Record that you checked it. gpg --lsign-key alice@example.org makes a local, non-exportable signature, so GnuPG stops warning you about this key.

How to publish your own key

On keys.openpgp.org (two minutes)

Upload with gpg --export you@example.org | curl -T - https://keys.openpgp.org. The server replies with a link: open it and ask for the confirmation email. Your address becomes searchable only after you click the link in that email. You can remove the address later from the same site.

On your own domain with WKD

1. Print the WKD file name for your address: gpg --with-wkd-hash -k you@example.org (the 32-character string next to your address).
2. Export the key in binary form under that name: gpg --no-armor --export you@example.org > <hash>.
3. Upload it to https://example.org/.well-known/openpgpkey/hu/<hash>, and create an empty file at /.well-known/openpgpkey/policy.
4. Serve both over HTTPS, the key as application/octet-stream, preferably with Access-Control-Allow-Origin: * so web mail clients can read it.
5. Test: gpg --auto-key-locate clear,nodefault,wkd --locate-keys you@example.org, or look yourself up with the PGP Key Lookup using the WKD only source.

Where people get it wrong

• Trusting the first search result. On unverified keyservers the first key for an address can be anyone's.
• Verifying the short key ID. 8-character IDs have been mass-forged. Compare the full fingerprint.
• Encrypting to an expired key. The owner moved on and may no longer have the private key. Ask for the current one.
• Never publishing a revocation. If a private key is lost or stolen, upload its revocation certificate everywhere the key was published, or people will keep encrypting to it.