keys.openpgp.org

About | News | Usage | FAQ | Stats | Privacy

On this page, we collect information on how to use keys.openpgp.org with different OpenPGP software products.
We are still in the process of adding more. If you are missing some, please write to us and we'll try to add it.

Web Interface

The web interface on keys.openpgp.org allows you to:

Enigmail

Enigmail for Thunderbird uses keys.openpgp.org by default since version 2.0.12.

Full support is available since Enigmail 2.1 (for Thunderbird 68 or newer):

GPG Suite

GPG Suite for macOS uses keys.openpgp.org by default since August 2019.

OpenKeychain

OpenKeychain for Android uses keys.openpgp.org by default since July 2019.

Note that there is no built-in support for upload and email address verification so far.

Pignus

Pignus for iOS uses keys.openpgp.org by default since November 2019.

GnuPG

To configure GnuPG to use keys.openpgp.org as keyserver, add this line to your gpg.conf file:

keyserver hkps://keys.openpgp.org

Retrieving keys

Uploading your key

Keys can be uploaded with GnuPG's --send-keys command, but identity information can't be verified that way to make the key searchable by email address (what does this mean?).

Troubleshooting

Usage via Tor

For users who want to be extra careful, keys.openpgp.org can be reached anonymously as an onion service. If you have Tor installed, use the following configuration:

keyserver hkp://zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion

WKD as a Service

The Web Key Directory (WKD) is a standard for discovery of OpenPGP keys by email address, via the domain of its email provider. It is used to discover unknown keys in some email clients, such as GpgOL.

keys.openpgp.org can be used as a managed WKD service for any domain. To do so, the domain simply needs a CNAME record that delegates its openpgpkey subdomain to wkd.keys.openpgp.org. It should be possible to do this in the web interface of any DNS hoster.

Once enabled for a domain, its verified addresses will automatically be available for lookup via WKD.

The CNAME record should look like this:

$ drill openpgpkey.example.org
...
openpgpkey.example.org. 300 IN CNAME wkd.keys.openpgp.org.

There is a simple status checker for testing the service:

$ curl 'https://wkd.keys.openpgp.org/status/?domain=openpgpkey.example.org'
CNAME lookup ok: openpgpkey.example.org resolves to wkd.keys.openpgp.org

For testing key retrieval:

$ gpg --locate-keys --auto-key-locate clear,nodefault,wkd address@example.org

API

We offer an API for integrated support in OpenPGP applications. Check out our API documentation.

Others

Missing a guide for your favorite implementation? This site is a work-in-progress, and we are looking to improve it. Drop us a line at if you want to help out!

Hagrid v1.0.0 built from 39c0e12

Powered by Sequoia-PGP

Background image retrieved from Subtle Patterns under CC BY-SA 3.0