What's the difference between PGP and GPG?

PGP is the original software and trademark (now owned by Symantec/Broadcom). GPG (GnuPG) is the free, open-source implementation of the OpenPGP standard. They are interoperable.

What algorithm should a modern PGP key use?

Ed25519 (EdDSA) for signing and X25519 (ECDH) for encryption are recommended as of 2024. RSA-4096 is still acceptable but slower. Avoid RSA-1024 and DSA-1024 — both are considered broken.

Can the parser validate the key's signature?

It parses and extracts key metadata (algorithm, key ID, fingerprint, user IDs, expiry). Full cryptographic self-signature verification requires the private key and is not performed here.

PGP Key Parser | DevTools Surf

DevTools Surf

Example: PGP Key Parser

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

Output

═══ Armor ═══
Block: BEGIN PGP PUBLIC KEY BLOCK
Checksum: =H2iB — CRC-24 matches, the body is intact
Body: 681 bytes in 3 packets

═══ Primary key ═══
Key ID: 0x967967FDF7F79320
Fingerprint: DDE1 998E 46BC 8281 6FFB F169 9679 67FD F7F7 9320
Version: v4 (SHA-1 fingerprint)
Algorithm: RSA (encrypt or sign) 2048-bit
Created: 2026-09-20T09:05:51Z (3.0 hours ago)
Expires: 2028-09-19T09:05:51Z (in 2.0 years)

═══ User IDs (1) ═══
• Alice Example <alice@example.com>

═══ Subkeys (0) ═══
ℹ No subkeys. Most modern keys keep the primary key for certification only and put signing and encryption on subkeys.

═══ Packet structure ═══
  # 1  tag  6  Public-Key                            269 bytes  old-format
  # 2  tag 13  User ID                                33 bytes  old-format
  # 3  tag  2  Signature                             371 bytes  old-format

═══ Signatures (1) ═══
positive certification of a user id: RSA (encrypt or sign), hashed with SHA-256, made 2026-09-20T09:05:51Z

═══ Findings ═══
✓ No structural problems, weak algorithms or expiry issues found.

═══ Check the same thing locally ═══
  gpg --show-keys --with-fingerprint key.asc
  gpg --list-packets key.asc

About PGP Key Parser

PGP Key Parser preview - Security / Crypto tool

Walk every packet of an armoured PGP public key: fingerprint, user IDs, subkeys and checksum. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Verify a developer's signing key fingerprint before trusting signed release artifacts.
Extract the key ID and creation date from an armored public key block without importing it into a keyring.
Check whether a key uses deprecated RSA-1024 or a modern RSA-4096/Ed25519 algorithm.
Parse keys submitted via web forms to confirm they are valid before storing them.

Tips

Paste the full armored block including the -----BEGIN PGP PUBLIC KEY BLOCK----- header and footer.
Check the fingerprint output against the sender's published fingerprint on a keyserver or their website — do not trust fingerprints sent in the same email as the key.
The User ID field shows the name and email the key was created for; verify it matches who you expect.

Fun Facts

PGP (Pretty Good Privacy) was created by Phil Zimmermann in 1991. He released it as freeware and was investigated by US Customs for three years for allegedly exporting cryptography without a license.
The OpenPGP standard (RFC 4880) was finalized in 2007, but most implementations still support keys created under the original 1996 RFC 2440 format.
PGP key fingerprints are 160-bit SHA-1 hashes. The cryptographic weakness of SHA-1 prompted the OpenPGP working group to move to SHA-256 fingerprints in the updated RFC 9580 (2024).

FAQ

What's the difference between PGP and GPG?: PGP is the original software and trademark (now owned by Symantec/Broadcom). GPG (GnuPG) is the free, open-source implementation of the OpenPGP standard. They are interoperable.
What algorithm should a modern PGP key use?: Ed25519 (EdDSA) for signing and X25519 (ECDH) for encryption are recommended as of 2024. RSA-4096 is still acceptable but slower. Avoid RSA-1024 and DSA-1024 — both are considered broken.
Can the parser validate the key's signature?: It parses and extracts key metadata (algorithm, key ID, fingerprint, user IDs, expiry). Full cryptographic self-signature verification requires the private key and is not performed here.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder