OpenPGP.js is a Javascript implementation of the OpenPGP protocol. This is defined in RFC 4880.
The openpgp npm package is a JavaScript implementation of the OpenPGP standard, which allows for encryption, decryption, signing, and verification of messages and files. It is widely used for secure communication and data protection.
Encrypting a message
This feature allows you to encrypt a message using a public key. The code sample demonstrates how to read a public key, create a message, and then encrypt it.
const openpgp = require('openpgp');
(async () => {
const publicKeyArmored = '-----BEGIN PGP PUBLIC KEY BLOCK ... END PGP PUBLIC KEY BLOCK-----';
const message = 'Hello, world!';
const publicKey = await openpgp.readKey({ armoredKey: publicKeyArmored });
const encrypted = await openpgp.encrypt({ message: await openpgp.createMessage({ text: message }), encryptionKeys: publicKey });
console.log(encrypted);
})();Decrypting a message
This feature allows you to decrypt a message using a private key and passphrase. The code sample demonstrates how to read a private key, decrypt it with a passphrase, read an encrypted message, and then decrypt it.
const openpgp = require('openpgp');
(async () => {
const privateKeyArmored = '-----BEGIN PGP PRIVATE KEY BLOCK ... END PGP PRIVATE KEY BLOCK-----';
const passphrase = 'yourPassphrase';
const encryptedMessage = '-----BEGIN PGP MESSAGE ... END PGP MESSAGE-----';
const privateKey = await openpgp.decryptKey({ privateKey: await openpgp.readPrivateKey({ armoredKey: privateKeyArmored }), passphrase });
const message = await openpgp.readMessage({ armoredMessage: encryptedMessage });
const { data: decrypted } = await openpgp.decrypt({ message, decryptionKeys: privateKey });
console.log(decrypted);
})();Signing a message
This feature allows you to sign a message using a private key and passphrase. The code sample demonstrates how to read a private key, decrypt it with a passphrase, create a message, and then sign it.
const openpgp = require('openpgp');
(async () => {
const privateKeyArmored = '-----BEGIN PGP PRIVATE KEY BLOCK ... END PGP PRIVATE KEY BLOCK-----';
const passphrase = 'yourPassphrase';
const message = 'Hello, world!';
const privateKey = await openpgp.decryptKey({ privateKey: await openpgp.readPrivateKey({ armoredKey: privateKeyArmored }), passphrase });
const signedMessage = await openpgp.sign({ message: await openpgp.createMessage({ text: message }), signingKeys: privateKey });
console.log(signedMessage);
})();Verifying a signed message
This feature allows you to verify a signed message using a public key. The code sample demonstrates how to read a public key, read a signed message, and then verify the signature.
const openpgp = require('openpgp');
(async () => {
const publicKeyArmored = '-----BEGIN PGP PUBLIC KEY BLOCK ... END PGP PUBLIC KEY BLOCK-----';
const signedMessage = '-----BEGIN PGP SIGNED MESSAGE ... END PGP SIGNED MESSAGE-----';
const publicKey = await openpgp.readKey({ armoredKey: publicKeyArmored });
const message = await openpgp.readMessage({ armoredMessage: signedMessage });
const verificationResult = await openpgp.verify({ message, verificationKeys: publicKey });
const { verified } = verificationResult.signatures[0];
try {
await verified;
console.log('Signature is valid');
} catch (e) {
console.log('Signature is invalid');
}
})();node-forge is a JavaScript library that provides a set of cryptographic utilities, including support for RSA, AES, and other encryption algorithms. It is more general-purpose compared to openpgp, which is specifically focused on the OpenPGP standard.
The crypto module is a built-in Node.js module that provides cryptographic functionality, including a set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify functions. It is more low-level compared to openpgp, which provides higher-level abstractions for OpenPGP operations.
kbpgp is a JavaScript library for OpenPGP encryption and decryption, similar to openpgp. It is designed to be compatible with the Keybase platform and provides a simpler API for common OpenPGP operations.
OpenPGP.js is a Javascript implementation of the OpenPGP protocol. This is defined in RFC 4880.
For server side use, install via npm:
npm install openpgp
var openpgp = require('openpgp');
var key = '-----BEGIN PGP PUBLIC KEY BLOCK ... END PGP PUBLIC KEY BLOCK-----';
var publicKey = openpgp.key.readArmored(key);
var pgpMessage = openpgp.encryptMessage(publicKey.keys, 'Hello, World!');
var openpgp = require('openpgp');
var key = '-----BEGIN PGP PRIVATE KEY BLOCK ... END PGP PRIVATE KEY BLOCK-----';
var privateKey = openpgp.key.readArmored(key).keys[0];
privateKey.decrypt('passphrase');
var pgpMessage = '-----BEGIN PGP MESSAGE ... END PGP MESSAGE-----';
pgpMessage = openpgp.message.readArmored(pgpMessage);
var plaintext = openpgp.decryptMessage(privateKey, pgpMessage);
Fetch a minified build under releases. The library can be loaded via AMD/require.js or accessed globally via window.openpgp.
OpenPGP.js currently only fully supports browsers that implement window.crypto.getRandomValues. If you can help us support more browsers and runtimes, please chip in!
It should be noted that js crypto apps deployed via regular web hosting (a.k.a. host-based security) provide users with less security than installable apps with auditable static versions. Installable apps can be deployed as a Firefox or Chrome packaged app. These apps are basically signed zip files and their runtimes typically enforce a strict Content Security Policy (CSP) to protect users against XSS. This blogpost explains the trust model of the web quite well.
It is also recommended to set a strong passphrase that protects the user's private key on disk.
To create your own build of the library, just run the following command after cloning the git repo. This will download all dependencies, run the tests and create a minifed bundle under dist/openpgp.min.js to use in your project:
npm install && npm test
A jsdoc build of our code comments is available at doc/index.html. Public calls should generally be made through the OpenPGP object doc/openpgp.html.
You can sign up for our mailing list and ask for help there. We've recently worked on getting our archive up and running.
You want to help, great! Go ahead and fork our repo, make your changes and send us a pull request.
GNU Lesser General Public License (2.1). Please take a look at the LICENSE file for more information.
Below is a collection of resources, many of these were projects that were in someway a precursor to the current OpenPGP.js project. If you'd like to add your link here, please do so in a pull request or email to the list.
FAQs
OpenPGP.js is a Javascript implementation of the OpenPGP protocol. This is defined in RFC 4880.
The npm package openpgp receives a total of 183,829 weekly downloads. As such, openpgp popularity was classified as popular.
We found that openpgp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.
Security News
Research
Socket's threat research team has detected five malicious npm packages targeting Roblox developers, deploying malware to steal credentials and personal data.
Security News
vlt introduced its new package manager and a serverless registry this week, innovating in a space where npm has stagnated.