Create an OpenPGP key pair with GnuPG and publish it

Updated November 2026

Run gpg --full-generate-key, accept the default Curve 25519 algorithm, set an expiry of one to three years, and protect the key with a strong passphrase. Then export the public half and publish it so other people can find it by your email address.

Before you start

Create the key step by step

gpg --full-generate-key

GnuPG asks a few questions. Here are the answers that suit most people:

Please select what kind of key you want:
   (1) RSA and RSA
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (9) ECC (sign and encrypt) *default*
  (10) ECC (sign only)
  (14) Existing key from card
  (16) ECC and Kyber
Your selection? 9
Please select which elliptic curve you want:
   (1) Curve 25519 *default*
   (4) NIST P-384
   (6) Brainpool P-256
Your selection? 1
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 2y
Key expires at Fri 03 Nov 2028 03:00:21 AM EDT
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Alice Example
Email address: alice@example.org
Comment:
You selected this USER-ID:
    "Alice Example <alice@example.org>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

A passphrase prompt (pinentry) then appears. Enter the passphrase twice. GnuPG finishes with:

gpg: revocation certificate stored as '/home/alice/.gnupg/openpgp-revocs.d/2734CC4B4895CD267A95E4F80AC7BF5195249C70.rev'
public and secret key created and signed.

pub   ed25519 2026-11-04 [SC] [expires: 2028-11-03]
      2734CC4B4895CD267A95E4F80AC7BF5195249C70
uid                      Alice Example <alice@example.org>
sub   cv25519 2026-11-04 [E] [expires: 2028-11-03]
      39966D5F7F12405F6A91D7AC9CA075E5DC803038

The 40-character line under pub is your key’s fingerprint. It is the key’s unique name. Give it to people so they can check that they have the right key. [SC] means the primary key can sign and certify. The cv25519 subkey marked [E] is used for encryption.

Leave the comment empty. Comments such as “work” or “home” only cause confusion. If you use several addresses, add them to one key later with gpg --quick-add-uid.

The one-line version

--quick-generate-key (short form --quick-gen-key) creates the same kind of key without the questions. The arguments are the user ID, then the algorithm, the usage and the expiry:

gpg --quick-generate-key "Alice Example <alice@example.org>" default default 2y

Use default for the algorithm and usage if you want the usual primary key plus encryption subkey. If you name a specific algorithm, GnuPG creates only a primary key with no encryption subkey. If you give only the user ID, GnuPG picks a default expiry. In our test with 2.5.24 it was three years. For no expiry, use never, but we do not recommend it.

Which algorithm and expiry

Curve 25519 (default)
An ed25519 signing key with a cv25519 encryption subkey. Keys and signatures are small, and the algorithm is fast and widely supported by current OpenPGP software. This is the right choice for nearly everyone.
RSA 3072 or 4096
Choose option (1) only if someone you work with uses very old software that cannot handle elliptic-curve keys. Larger RSA keys are slower and much bigger, and are no more useful in practice.
ECC and Kyber (GnuPG 2.5)
Option (16), or pqc as the algorithm in --quick-generate-key, adds a post-quantum ky768_bp256 encryption subkey. In our test it produced a newer key version with a 64-character fingerprint. Before you rely on such a key, check that your correspondents’ programs can use it. See Security questions for background.

Expiry: pick one to three years. An expiry date is not a deadline for creating a new key. You can move it later whenever you like with gpg --quick-set-expire (Backup and revoke). It works as a safety net: if you lose the key and the passphrase, it stops working by itself.

Keep the revocation certificate

GnuPG automatically saved a revocation certificate in ~/.gnupg/openpgp-revocs.d/, named after your fingerprint. If your secret key is ever stolen, or you lose the passphrase, importing and publishing this certificate tells everyone to stop using the key. As a precaution, GnuPG puts a colon in front of the first -----BEGIN line of this file. You remove that colon only when you really mean to revoke. Copy the file somewhere safe and offline, such as a USB stick in a drawer or a printout. Anyone who has the file can revoke your key.

To make a new certificate with a stated reason (for example “key superseded”), use:

gpg --output alice-revoke.asc --generate-revocation alice@example.org

Back up your secret key too: gpg --export-secret-keys --armor into a file kept offline. Backup and revoke explains how.

Export your public key

gpg --export --armor --output alice-public.asc alice@example.org

--armor writes the key as text (“ASCII armor”) beginning with -----BEGIN PGP PUBLIC KEY BLOCK-----, so you can paste it into an email or a web page. Without --armor you get a binary file. Never send the output of --export-secret-keys to anyone.

To show the fingerprint at any time:

gpg --fingerprint alice@example.org
pub   ed25519 2026-11-04 [SC] [expires: 2028-11-03]
      2734 CC4B 4895 CD26 7A95  E4F8 0AC7 BF51 9524 9C70
uid           [ultimate] Alice Example <alice@example.org>
sub   cv25519 2026-11-04 [E] [expires: 2028-11-03]
      3996 6D5F 7F12 405F 6A91  D7AC 9CA0 75E5 DC80 3038

The spaces make it easier to read aloud. [ultimate] appears because this is your own key.

Publish your public key

keys.openpgp.org

keys.openpgp.org only makes your key searchable by email address after you confirm that address. The quickest way is to pipe the key to the server, which replies with a link to the verification page:

gpg --export alice@example.org | curl -T - https://keys.openpgp.org

You can also upload the alice-public.asc file on the keys.openpgp.org upload page. Either way, the server then emails you a confirmation link. You can also send the key with GnuPG itself:

gpg --keyserver hkps://keys.openpgp.org --send-keys 2734CC4B4895CD267A95E4F80AC7BF5195249C70

Keys sent this way can be found by fingerprint, but not by email address until you verify it. Since version 2.5.3, GnuPG has no default keyserver, which is why the command names one. More details are in keys.openpgp.org. The old *.pgp.net keyservers no longer run (Replacing subkeys.pgp.net).

Web Key Directory (your own domain)

If you control the web server for your email domain, publish the key in a Web Key Directory (WKD). Mail programs and gpg --locate-keys alice@example.org then find it automatically, with no keyserver involved. See Web Key Directory.

Mistakes to avoid

Next: encrypt a file or sign one.

Sources