# PGP decrypt

Decrypt a PGP message online with your private key or the password it was encrypted with. Verifies embedded signatures, handles binary payloads, runs in your browser.

## Run it

- **CLI:** `gizza tool pgp-decrypt "Paste the whole ASCII-armored PGP message block here"`
- **Web:** https://gizza.ai/tools/pgp-decrypt/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/pgp-decrypt/tool.json

## Inputs

- `message` — Encrypted message _(field)_
- `private_key` — Your private key (public-key encrypted messages) _(field)_
- `passphrase` — Passphrase or message password _(field)_
- `public_key` — Signer's public key (optional, to verify a signature) _(field)_
- `output_format` — Show the plaintext as _(field)_

## Output

- Decryption result (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `message` — Encrypted message
- `private_key` — Your private key (public-key encrypted messages)
- `passphrase` — Passphrase or message password
- `public_key` — Signer's public key (optional, to verify a signature)
- `output_format` — Show the plaintext as

Example: `https://gizza.ai/tools/pgp-decrypt/?message=Paste%20the%20whole%20ASCII-armored%20PGP%20message%20block%20here&private_key=Paste%20your%20ASCII-armored%20private%20key%20block%3B%20leave%20blank%20for%20password-encrypted%20messages&passphrase=Unlocks%20a%20protected%20private%20key%20%E2%80%94%20or%20the%20password%20a%20%27gpg%20--symmetric%27%20message%20was%20made%20with&public_key=Paste%20the%20signer%27s%20ASCII-armored%20public%20key%20block%2C%20or%20leave%20blank%20to%20skip%20verification&output_format=auto`

---

## About this tool

PGP decrypt opens an **ASCII-armored OpenPGP (PGP/GPG) message** and shows the decrypted payload as text, base64, or hex. Paste the full `-----BEGIN PGP MESSAGE-----` block, then provide either the recipient private key (for public-key encrypted mail) or the password used for a symmetric `gpg --symmetric` message. Everything runs locally in WebAssembly, so messages, private keys, and passphrases never leave your browser.

### What it handles

- **Public-key encrypted messages** — paste the matching `-----BEGIN PGP PRIVATE KEY BLOCK-----` key. If that key is passphrase-protected, enter the passphrase too.
- **Password-encrypted messages** — leave the private key blank and enter the message password in the passphrase field.
- **Compressed payloads** — common OpenPGP compression layers are decompressed before output.
- **Encrypted-and-signed messages** — signature metadata is reported. Paste the signer's public key to verify the signature instead of only seeing that one was present.
- **Binary payloads** — `auto` shows UTF-8 text when possible and falls back to base64 for binary bytes. Choose `base64` or `hex` when you want an explicit encoding.

### Worked example

1. Paste a complete armored encrypted message in **Encrypted message**.
2. Paste the matching armored private key in **Your private key**.
3. If the private key is protected, enter its passphrase. For a symmetric message, leave the private key blank and enter the message password instead.
4. Leave **Show the plaintext as** set to **Auto** for normal text messages.

A successful text message returns JSON like:

```json
{
  "plaintext": "attack at dawn",
  "encryption": "public-key",
  "output_format": "text",
  "bytes": 14,
  "binary": false,
  "compressed": false
}
```

For signed messages, the result also includes a `signature` object. `valid: true` means the supplied public key verified the embedded signature; `valid: null` means the message was signed but no public key was supplied.

### Limits and edge cases

- The armored input is capped at **4 MiB** to keep browser memory usage predictable.
- The tool accepts armored OpenPGP messages, not raw `.gpg` binary files. Armor binary files first or decrypt them with a desktop OpenPGP client.
- A valid signature proves the message matches the supplied signing key; it does not prove you trust that key. Compare fingerprints through a trusted channel.
- If the private key is wrong, the error includes the recipient key ID when the message exposes one.

## FAQ

<details>
<summary>Do I need a private key, a passphrase, or both?</summary>

For a message encrypted to your public key, paste the matching private key. If that private key is protected, enter its passphrase too. For a symmetric `gpg --symmetric` message, leave the private key blank and enter the message password in the passphrase field.

</details>

<details>
<summary>Can this decrypt binary files?</summary>

It can decrypt binary payloads inside an armored OpenPGP message, but the page returns them as text encodings. Use `auto` to fall back to base64 when bytes are not UTF-8, or choose `base64` or `hex` explicitly. Very large encrypted files are better handled by a desktop OpenPGP client.

</details>

<details>
<summary>Why does it say the private key is not a recipient?</summary>

OpenPGP messages are encrypted to one or more recipient key IDs. That error means the pasted private key does not match any recipient session key in the message, or the message uses a hidden recipient and this key still could not unlock it. Check that you pasted the private key for the address or fingerprint the sender used.

</details>

<details>
<summary>Does this verify encrypted signatures automatically?</summary>

The tool reports when a decrypted message contains a signature. To actually verify it, paste the signer's public key in the optional public-key field. Without that key, the result marks the signature as present but unverified.

</details>

## Related tools

- [AES cipher](https://gizza.ai/tools/aes-cipher/): Encrypt or decrypt text with AES in CBC, CTR, GCM or ECB mode and 128/192/256-bit keys, with hex/base64 I/O — in your browser. Nothing is uploaded.
- [AES Key Wrap](https://gizza.ai/tools/aes-key-wrap/): Wrap and unwrap cryptographic keys with AES Key Wrap (KW / RFC 3394, KWP / RFC 5649) using a 128/192/256-bit KEK — hex or base64, free and in-browser.
- [Age encrypt](https://gizza.ai/tools/age-encrypt/): Encrypt small text into an ASCII-armored age ciphertext with a passphrase or native X25519 recipients.
- [Age Key Generator](https://gizza.ai/tools/age-keygen/): Generate an age X25519 identity and its shareable age1 public recipient in your browser, or derive the recipient from an identity you already have.
- [Amcache Parser](https://gizza.ai/tools/amcache-parser/): Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.