Can I encrypt with a public key?

Yes, you encrypt messages using the recipient's public key. The recipient then decrypts the message with their private key, which never leaves their machine. This allows vendors to send you encrypted tracking codes that only you can read [2].

How to find my PGP key?

Run `gpg --list-keys` in your terminal to see all public keys stored on your system. To export your own public key, use `gpg --armor --export your-email@example.com` and copy the entire output block. Your key fingerprint appears in the output of `gpg --fingerprint`.

How do I generate a PGP key?

Run `gpg --gen-key` in your terminal to create a new primary keypair [7]. Choose a key size of at least 1024 bits; 2048 bits is the highest recommended option [1]. The process automatically creates a revocation certificate and stores it in the openpgp-revocs.d directory [7]. For faster generation without multiple prompts, use `gpg --quick-gen-key` instead [9].

Where should I register my PGP public key?

Upload your public key directly to your darknet market vendor profile to enable encrypted communication with buyers [2]. Optionally submit it to keys.openpgp.org, which strips your user ID until you verify ownership via email [8]. PGP Global Directory sends verification messages and allows you to manage or remove your keys later [10]. Never upload the same public key to multiple market accounts to prevent identity linking [2].

How are PGP/GPG private keys stored?

GnuPG stores private keys locally on your machine in a protected keyring. When you generate a keypair, a revocation certificate is automatically created and saved in the openpgp-revocs.d directory [7]. Delete private keys from old market accounts, busted markets, or exit-scammed platforms to minimize the amount of sensitive information an attacker could decrypt if your system is compromised [2].

How to decrypt a PGP public key?

You cannot decrypt a public key because it contains no encrypted data. Public keys are used to encrypt messages, not to be decrypted themselves. Verify a public key's authenticity by checking its fingerprint through an independent channel like phone or in-person contact [3]. Perform verification locally in GnuPG where the key never leaves your machine [6].

Understanding Vendor PGP Keys

This guide is for vendors seeking to implement PGP keys for secure transactions and communications.

Date: Oct 5, 2026

user managing PGP keys in a dark office — Managing PGP keys for secure communications and transactions.

A vendor PGP key is a public cryptographic identifier that proves a seller's identity across darknet markets and enables encrypted communication with buyers. Vendors generate unique key pairs for each market account using GnuPG (minimum 768 bits, default 1024 bits, recommended 2048 bits¹) and upload only the public key to their profile². Buyers verify the key's fingerprint through an independent channel—never the same one used to download it—to confirm authenticity³. Start by locating the vendor's public key block on their market profile page.

What You Get

Vendor Identity Verification

You learn how to verify a vendor's PGP key fingerprint through an independent communication channel, not the same one used to download the key [3]. This prevents accepting counterfeit keys created with stolen names and email addresses [4].

Secure Transaction Communication

Vendors use uploaded public keys to encrypt sensitive shipment details like tracking codes before sending them to you [2]. You decrypt these messages with your private key, ensuring no one intercepts the information.

Cross-Market Vendor Authentication

PGP public keys serve as trusted vendor authentication across multiple darknet marketplaces [5]. You can verify a vendor's identity by matching their key fingerprint to the one they published on their profile or external channels.

Two-Factor Account Protection

Some markets require you to decrypt a message containing a special code to prove account ownership [2]. This adds a second authentication layer beyond your password, protecting your account even if credentials leak.

Protection from Key Substitution Attacks

You understand why verifying fingerprints in person, over the phone, or through another trusted channel is critical [3]. Downloading a key and verifying it through the same channel leaves you vulnerable to man-in-the-middle attacks.

Safe Key Management Practices

You learn to perform key verification locally in GnuPG where keys never leave your machine [6]. This protects you from clipboard-hijacking malware disguised as web-based PGP validators [6].

How to Obtain and Upload a Vendor PGP Key

Generate your keypair locally: Run gpg --gen-key in your terminal to create a new primary keypair⁷. Choose a key size of at least 1024 bits; GnuPG defaults to this size and supports up to 2048 bits¹. Select an expiration date during setup — you can choose no expiration or set it in days, weeks, months, or years¹. The process takes under one minute. GnuPG automatically creates a revocation certificate and stores it in the openpgp-revocs.d directory⁷.
Export your public key: Use gpg --armor --export your-email@example.com to output your public key in text format. Copy the entire block from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK-----. This key never contains your private key and is safe to share.
Upload to your market profile: Log into your vendor account and paste the public key into the PGP key field in your profile settings. Generate a unique keypair for each market account you create². Never reuse the same public key across multiple accounts — this prevents linking your market identities together².
Verify the upload worked: Send yourself a test message using the market's encryption feature. Decrypt it with your private key using gpg --decrypt message.txt. If you can read the plaintext, the upload succeeded. Some markets use this as two-factor authentication by requiring you to decrypt a code to prove account ownership².
Share your fingerprint through a second channel: Run gpg --fingerprint your-email@example.com to display your key's fingerprint. Post this 40-character string on your vendor profile or in product listings. Buyers should verify this fingerprint matches the key they download, using a different communication method than the one used to get the key³. Anyone can create a counterfeit key with your name and email⁴, so fingerprint verification through an independent channel is the only reliable check.
Delete old keys when you stop using an account: Remove private keys from closed accounts, exit-scammed markets, or busted platforms using gpg --delete-secret-keys key-id². This limits what an attacker could decrypt if your system is compromised². Keep only the keys you actively use.
Never paste keys into web validators: Clipboard-hijacking malware has been found on fake PGP validation websites⁶. These pages capture whatever you paste — keys, wallet addresses, passwords, or recovery phrases⁶. Verify keys locally in GnuPG where the key never leaves your machine⁶.

Risks, Limitations, and Guarantees

Using PGP keys for vendor transactions involves several risks and limitations. One major risk is the potential for counterfeit public keys. An attacker can create a fake key using another person's name and email address. This makes fingerprint verification through independent channels crucial for confirming authenticity⁴.

Malware poses another significant threat. Clipboard-hijacking malware can capture sensitive data when users paste their public keys into untrusted web pages⁶. Always verify keys locally using GnuPG, ensuring that they never leave your machine during the verification process⁶.

Vendors face limitations in key management. Public keys should only be uploaded to a single market account to avoid identity linking across platforms². Vendors must also delete private keys from inactive or compromised accounts to minimize exposure to potential attacks².

When generating keys, ensure the size is at least 768 bits, with 2048 bits being the recommended maximum for robust security¹. Be aware that some keyservers may strip user IDs from uploaded keys until ownership is confirmed via email⁸.

Guarantees are limited. While PGP offers encryption and identity verification, it heavily relies on user diligence in verifying fingerprints and managing keys. Following best practices is essential to ensure secure transactions.

Straight answers

What are the main uses of PGP encryption?: PGP encryption protects sensitive shipment information like tracking codes that vendors send to buyers². It also serves as two-factor authentication by requiring you to decrypt a message containing a special code to prove account ownership². Vendors use PGP keys to build trusted brands across darknet marketplaces, with username and key pairs serving as authentication methods⁵.
Can I encrypt with a public key?: Yes, you encrypt messages using the recipient's public key. The recipient then decrypts the message with their private key, which never leaves their machine. This allows vendors to send you encrypted tracking codes that only you can read².
How to find my PGP key?: Run gpg --list-keys in your terminal to see all public keys stored on your system. To export your own public key, use gpg --armor --export your-email@example.com and copy the entire output block. Your key fingerprint appears in the output of gpg --fingerprint.
How do I generate a PGP key?: Run gpg --gen-key in your terminal to create a new primary keypair⁷. Choose a key size of at least 1024 bits; 2048 bits is the highest recommended option¹. The process automatically creates a revocation certificate and stores it in the openpgp-revocs.d directory⁷. For faster generation without multiple prompts, use gpg --quick-gen-key instead⁹.
Where should I register my PGP public key?: Upload your public key directly to your darknet market vendor profile to enable encrypted communication with buyers². Optionally submit it to keys.openpgp.org, which strips your user ID until you verify ownership via email⁸. PGP Global Directory sends verification messages and allows you to manage or remove your keys later¹⁰. Never upload the same public key to multiple market accounts to prevent identity linking².
How are PGP/GPG private keys stored?: GnuPG stores private keys locally on your machine in a protected keyring. When you generate a keypair, a revocation certificate is automatically created and saved in the openpgp-revocs.d directory⁷. Delete private keys from old market accounts, busted markets, or exit-scammed platforms to minimize the amount of sensitive information an attacker could decrypt if your system is compromised².
How to decrypt a PGP public key?: You cannot decrypt a public key because it contains no encrypted data. Public keys are used to encrypt messages, not to be decrypted themselves. Verify a public key's authenticity by checking its fingerprint through an independent channel like phone or in-person contact³. Perform verification locally in GnuPG where the key never leaves your machine⁶.