Public Key vs Private Key — Encryption Explained Simply
Almost everything you write online — addresses, contracts, reports, credentials — travels through and gets stored on machines you don't control. A key pair fixes that: one key the whole world can see, one key that never leaves your device. Here's how the two work together, and how Kleopatra makes them usable by anyone.
Think of your public key as a personal mailbox with a slot: you can bolt it to your front door, print it in a newspaper, or paste it in your email signature. Anyone can drop a letter in. Your private key is the only key that opens that mailbox. The two are generated together as a mathematically linked pair — what one locks, only the other unlocks.
When someone wants to send you something confidential, they encrypt it with your public key. From that moment the message is an unreadable block of text for everyone — the messaging app, the email provider, an attacker who intercepts it, even the sender themselves can no longer read it. Only your private key can turn it back into the original message.
Why isn't HTTPS enough? The padlock in your browser only protects data while it travels between you and a server. Once it arrives, it sits in plain text on that server — readable by the company, its employees, its subcontractors, and whoever breaches them. Public-key encryption is end-to-end: the content stays sealed until it reaches the one person meant to read it, no matter how many services relay or store it in between.
This also works in reverse, and that's the second superpower of a key pair: signing. Something encrypted (signed) with your private key can be verified by anyone using your public key — proving the message really came from you and wasn't altered. Encryption gives you secrecy; signatures give you authenticity.
How Kleopatra helps: Kleopatra turns all of this into a few clicks. Generate a key pair in your browser (Curve 25519 or RSA 4096), keep your private key on your device, share your public key with one click, and encrypt, decrypt, sign, and verify from a clean interface — no command line, no installation. Everything runs locally in your browser; with optional Online Sync your keys are AES-256-encrypted on your device before they're backed up, so even our server can't read them. There's also a native desktop app for macOS and Windows.
The Two Keys at a Glance
Public key — share it freely
Like a mailbox slot: anyone can use it to send you an encrypted message. Publishing it is safe — it can only lock, never unlock.
Private key — never leaves you
The only key that opens your mailbox. It stays on your device, ideally protected by a passphrase. Whoever holds it can read your mail and sign as you.
Together — lock & unlock
They are generated as one mathematical pair. Encrypted with the public key → only the private key decrypts. Signed with the private key → anyone verifies with the public key.
Two Everyday Examples
Public-key encryption isn't just for spies and sysadmins — it solves ordinary problems the moment a message is too sensitive for a plain chat or email.
Sending your home address to an online seller
You buy something from a marketplace seller or a small shop and they ask for your delivery address in the chat. That chat is stored forever on someone's server. Instead: ask for their public key, paste it into Kleopatra, encrypt your address, and send the scrambled block. The platform, its moderators, and any future data breach see only gibberish — the seller alone can decrypt it.
Submitting a confidential report to a company
Many companies publish a PGP public key on their security or ethics page precisely for this. Import that key into Kleopatra, write your report — a vulnerability you found, a compliance concern, sensitive evidence — encrypt it, and email the block. Even if the mailbox is shared, forwarded, or intercepted, only the security team's private key can open it. Sign it with your own key if you want them to verify it's really you.
What Kleopatra Does for You
One-click key pair
Generate a modern Curve 25519 or RSA 4096 key pair in seconds, entirely in your browser. Export and back up your keys anytime.
Encrypt, decrypt, sign, verify
Paste a key or a message and go. No command line, no installs — and nothing you type ever reaches our servers.
Encrypted sync & desktop app
Optional Online Sync backs up your keys AES-256-encrypted on your device before upload, so only your password unlocks them — across the web app and the macOS/Windows desktop app.
Your privacy is guaranteed by design
All cryptographic operations in Kleopatra run entirely in your browser. Nothing you type, encrypt, decrypt, or generate is ever sent to our servers. There are no server logs, no analytics on your keys, and no accounts required. The code is open-source — you can verify every claim yourself.
Frequently Asked Questions
Is it safe to share my public key?
Yes — that's exactly what it's for. A public key can only encrypt messages to you and verify your signatures. It cannot decrypt anything, and it doesn't reveal your private key.
What happens if I lose my private key?
Messages encrypted to you become permanently unreadable — there is no reset button, which is precisely what makes the system trustworthy. Back up your private key (Kleopatra lets you export it) and consider the encrypted Online Sync so a lost device doesn't mean lost keys.
How is this different from the padlock (HTTPS) in my browser?
HTTPS protects data in transit between you and a server, but the server itself reads everything. Public-key encryption protects the content end-to-end: only the person holding the matching private key can ever read it, no matter where it travels or is stored.
Do both sides need Kleopatra?
No. Kleopatra produces standard OpenPGP messages. The other side can use any OpenPGP tool — GPG, the Gpg4win Kleopatra desktop app, ProtonMail, or Kleopatra in their own browser.