Last updated
Key Size Comparison
- 2048-bit RSA: Good security for most uses, faster operations, widely compatible
- 4096-bit RSA: Stronger long-term security, slightly slower, recommended for sensitive communications
- Both sizes use the same asymmetric encryption model — only the computational difficulty of breaking the key differs
- For new keys generated today, 4096-bit is the recommended choice given increasing computing power
Passphrase Best Practices
- Use at least 20 characters — a passphrase, not just a password
- A sequence of random words works well: "correct-horse-battery-staple-sunrise"
- Store it in a password manager alongside a backup of your private key
- Never share your passphrase — it protects your private key file from unauthorized use
- If you forget your passphrase, your private key is permanently inaccessible
Examples
Example 1: Generating a 4096-bit RSA Key Pair
Fill in your details and select key size to generate a key pair:
Name: Alice Johnson
Email: alice@example.com
Key Size: 4096-bit
Expiration: 2 years
Passphrase: correct-horse-battery-staple-2024
Generated public key (ASCII-armored format):
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGXk...
[base64 encoded key data]
...AB3T==
=xYzW
-----END PGP PUBLIC KEY BLOCK-----
Generated private key (keep this secret and back it up securely):
-----BEGIN PGP PRIVATE KEY BLOCK-----
lQdGBGXk...
[base64 encoded encrypted private key data]
...Qr9A==
=mNpL
-----END PGP PRIVATE KEY BLOCK-----
Example 2: Key Fingerprint Verification
After generating your key, verify its fingerprint to share with contacts for out-of-band verification:
Key Fingerprint:
A1B2 C3D4 E5F6 7890 1234 5678 9ABC DEF0 1234 5678
Short Key ID: 0x12345678
Long Key ID: 0x9ABCDEF012345678
Share your fingerprint via a separate channel (in person, phone call) so contacts can confirm they have the right key. Never rely solely on email to verify a fingerprint.
Example 3: Encrypting a Message with a Recipient's Public Key
Once you have a recipient's public key, encrypt a message for them:
-----BEGIN PGP MESSAGE-----
hQIMA...
[encrypted message content in base64]
...Zp==
=AbCd
-----END PGP MESSAGE-----
Only the holder of the corresponding private key can decrypt this message. Even if intercepted in transit, the content remains unreadable without the private key and its passphrase.