Public keyservers: what they are and what to use now
A keyserver is a public directory of OpenPGP keys. The old pgp.net keyservers (wwwkeys.pgp.net, subkeys.pgp.net, pool.subkeys.pgp.net and the country names under them) no longer run. Today you find keys on keys.openpgp.org, keyserver.ubuntu.com, through the Web Key Directory, or straight from the publisher.
What a keyserver does
To encrypt a message to someone, or to check their signature, you need their public key. A keyserver stores public keys and hands them out when you ask by email address, key ID or fingerprint. Programs also go back to the keyserver to refresh keys they already have, which is how a new subkey, a new expiry date or a revocation reaches you.
A keyserver is a delivery service, not a notary. Anyone can upload a key with any name and email address on it. Before you trust a key you got from a keyserver, compare its full fingerprint with one you got from the owner in another way: their website over HTTPS, a business card, a phone call, a signed release note.
What happened to the pgp.net keyservers
For many years the pgp.net names pointed at keyservers run at universities and other sites, which copied keys among themselves. You could reach them on the web (http://wwwkeys.pgp.net:11371/pks/lookup), from gpg --keyserver subkeys.pgp.net, by email (pgp-public-keys@keys.pgp.net) and over FTP. That network has stopped. As of November 2026, nothing answers on the keyserver port (11371) of these names, so commands that use them fail with errors such as gpg: keyserver receive failed: No keyserver available.
This site does not run a keyserver. Old web links to /pks/lookup open the key lookup page, which fetches the key from keys.openpgp.org. For commands and scripts, see what to use instead of subkeys.pgp.net. The keyserver history tells the longer story.
Where to find keys today
| Source | How it works | Good for |
|---|---|---|
| keys.openpgp.org | Publishes a name and email address only after the owner confirms the address by email. Strips third-party signatures. One key per address. | Finding a person's key by email; publishing your own key |
| keyserver.ubuntu.com | Runs Hockeypuck, which synchronizes with other keyservers. Does not check email addresses, and uploaded keys stay; a search can return several keys for one address. | Fetching software-signing and repository keys by fingerprint |
| Web Key Directory (WKD) | The key is served by the email domain itself, under /.well-known/openpgpkey/. | Keys for addresses at domains that publish one |
| Publisher or distribution | The key file on the vendor's HTTPS site, or a keyring package such as debian-archive-keyring. | APT repositories and software downloads |
Three commands to start with
Fetch a key by its full fingerprint from keys.openpgp.org:
gpg --keyserver hkps://keys.openpgp.org --recv-keys <FINGERPRINT>Find a key by email address, trying the Web Key Directory first and then the keyserver:
gpg --auto-key-locate clear,wkd,keyserver --keyserver hkps://keys.openpgp.org --locate-keys alice@example.orgMake a keyserver your default, so you can drop --keyserver: put this line in ~/.gnupg/dirmngr.conf, then run gpgconf --reload dirmngr.
keyserver hkps://keys.openpgp.orgUpstream GnuPG has had no built-in default keyserver since version 2.5.3 (the current release is 2.5.24, as of November 2026). Debian's GnuPG 2.4 defaults to keys.openpgp.org. So always pass --keyserver or set one in dirmngr.conf.
Which one should you use?
- Looking for a person's key: try WKD and keys.openpgp.org. A hit there means the owner confirmed the address.
- Publishing your own key: upload it to keys.openpgp.org and confirm your address; if you control your mail domain, publish it by WKD as well.
- Repository or release keys: use the fingerprint from the vendor's own documentation. keyserver.ubuntu.com usually has these keys.
- Scripts: always ask for the full 40-character fingerprint, never an 8-digit short ID. The HKP page explains why.
Pages in this section
- Key lookupLook up an OpenPGP public key by fingerprint, key ID or email address. Old wwwkeys.pgp.net and subkeys.pgp.net /pks/lookup links land here.
- Replacing subkeys.pgp.netsubkeys.pgp.net, wwwkeys.pgp.net and pool.subkeys.pgp.net no longer run a keyserver. Tested replacements for gpg, dirmngr.conf and apt-key commands.
- keys.openpgp.orgHow keys.openpgp.org works: upload your key, confirm your email, find keys by address or fingerprint with gpg, and what the server strips or will not publish.
- HKP protocolThe HTTP Keyserver Protocol explained: /pks/lookup with op=get, index and vindex, options=mr, fingerprint=on, ports 11371 and 443, and why short key IDs are unsafe.
- Web Key DirectoryHow WKD lets a mail domain serve its users' OpenPGP keys over HTTPS: the hashed URL, gpg --locate-keys, gpg-wks-client --install-key, nginx and Apache setups, and tests.
- Email keyserverHow the 1990s email keyserver at pgp-public-keys@keys.pgp.net worked, what its ADD, INDEX, GET, MGET and LAST commands did, and what to use now that it is gone.
- Keyserver historyFrom 1990s email keyservers and keys.pgp.net to PKS, SKS, the 2019 certificate flooding attack, the 2021 end of the SKS pool, Hockeypuck and keys.openpgp.org.
- Run a keyserverWhen your own keyserver makes sense, how to install Hockeypuck 2.4 with Docker or from source, a working config, peering, key deletion, and privacy risks.