Search public PGP keyservers for encryption keys by email, name, or key ID via public APIs.
This tool searches public OpenPGP keyservers for encryption and signing keys. Enter an email address, a name, or a key ID, and it queries servers such as keyserver.ubuntu.com and keys.openpgp.org over the HKP protocol, returning the matching keys with their fingerprints, creation and expiry dates, and the identities attached to each. The thing people most often get wrong: a keyserver result is not proof of identity. Anyone can upload a key claiming any email address, and no keyserver verifies that claim. Treat every hit as an unverified lead, and confirm the fingerprint through a channel you trust before relying on the key.
The tool sends an HKP lookup to the servers, hitting the pks/lookup endpoint with op=index to list matching keys or op=get to return the full armored key block. The response for each key shows its ID, algorithm, bit length, creation and expiry dates, fingerprint, and user IDs. The search string travels to the servers you query, so it is visible to them and their operators.
Keyservers are unmoderated upload repositories. The name and email in a key's user IDs are typed by whoever uploaded it, so a match proves only that a key carrying those strings exists. GnuPG records keyserver-fetched keys as untrusted until you validate the fingerprint out of band. The servers also no longer form one synchronized pool: the SKS pool has been wound down, and different servers now hold different keys.
Importing is safe in the sense that a key is just data and GnuPG records it as untrusted, but do not treat the import as verification. The user IDs are unverified, so check the full fingerprint through a channel you trust, such as asking the person directly, and set the key's trust level yourself. Expired or revoked keys import too.
Keyservers are not one synchronized database anymore, so coverage differs. keys.openpgp.org in particular strips any user ID whose email the owner has not verified by replying to a confirmation message, which removes some keys entirely and hides identities on others. A miss on one server does not prove the key does not exist; check a second server.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.