PGP From Scratch for Market Buyers: Key Generation, Encrypting an Address, and Verifying Vendor Signatures

Encrypting your address before sending it to a vendor might seem like overkill at first, but it stops casual snoops from reading it in plain text. PGP does exactly that job without any server involvement. The KeychainPGP web app handles the whole process locally in your browser, and the steps match what you need for market communications. I walked through this exact flow myself last month to set up secure contact with a vendor who insisted on encrypted details. It took under five minutes once the keys were ready, and the clipboard workflow kept everything fast even when switching between tabs.

Generating Your PGP Key Pair

Start by opening the KeychainPGP web app at keychainpgp.github.io in any modern browser. Nothing gets sent to a server because the engine runs entirely in your browser via WebAssembly. Click the Keys tab and create a new key. Enter your name and email address exactly as you want them recorded in the key identity. The tool immediately generates a modern Ed25519 plus X25519 key pair for you. That gives you both the public key you can share and the private key you must keep secret at all costs.

Generating the key takes only a few seconds. No algorithm choices or expiration dates appear because the app uses secure defaults. Once complete, the key appears in your list with the name and email you provided. This pair is what lets you encrypt messages to someone else and decrypt what they send back. In a market setting, this setup lets you encrypt your own address so a vendor can receive it without seeing it in plain text if the channel gets intercepted.

Export the public key block after generation. Copy the entire ASCII-armored text starting from —–BEGIN PGP PUBLIC KEY BLOCK—– through —–END PGP PUBLIC KEY BLOCK—–. Save it somewhere safe for now, but the important part comes next when you share it.

Sharing Your Public Key and Importing Vendor Keys

Send your public key block to the vendor through a trusted out-of-band channel. Do not post it on any market forum where logs might expose it. Once they give you their key in return, copy the entire public key block they provide. Paste it into the Keys tab of KeychainPGP. The app detects the block automatically and imports it so the vendor appears in your key list with their name and email.

Importing the key gives you their mailbox slot for encrypted messages. Before you encrypt anything sensitive, verify the fingerprint. Compare the short string of characters that uniquely identifies the key with the one the vendor tells you in person or over a separate phone call. This step blocks man-in-the-middle attacks where someone swaps in a fake key. The context stresses this exact check to confirm the key genuinely belongs to the person you intend to talk to.

If you prefer the desktop app instead, the same import steps work. Open the Keys tab, click Import Key, and paste the block. The clipboard-first design means you can grab the public key from any source and import it without leaving the app. Always treat your private key as untouchable. Back it up once in a secure offline location, then never expose it again.

Encrypting an Address

With both keys in the list, you can encrypt your address to the vendor. Go to the Encrypt tab. Type or paste your address in plain text. Select the vendor from the key list. Click Encrypt to Clipboard. The app returns an ASCII-armored PGP message block starting with —–BEGIN PGP MESSAGE—–. Copy that block and paste it into your message to the vendor.

The encrypted output looks like this example block: —–BEGIN PGP MESSAGE—– followed by the scrambled data and —–END PGP MESSAGE—–. Only the vendor can read it because they hold the matching private key. Even if someone intercepts the message, the address stays unreadable gibberish. This matches the exact workflow in the KeychainPGP docs for protecting sensitive information like contact details in a darknet transaction.

For the desktop app the process speeds up further. Type your address in any window, copy it with Ctrl+C, then press Ctrl+Shift+E to encrypt the clipboard contents to your default recipient. Paste the result with Ctrl+V. The entire cycle takes about one second once keys are set up. Use this when the vendor requires your address in encrypted form to avoid plain-text leaks during checkout or finalization.

Keep the encrypted block short and clear. Include nothing else that could identify you. The vendor receives the protected address, decrypts it locally, and can proceed with the transaction. This setup ensures your address never travels in readable form across whatever channel you choose.

Verifying Vendor Signatures

Vendors often sign messages to prove they sent the confirmation or final transaction details. You verify those signatures using the public key you already imported. The process starts with the signed message block. When you receive it, open the message and copy the full block from —–BEGIN PGP SIGNED MESSAGE—– through —–END PGP SIGNATURE—–.

KeychainPGP handles the verification directly in the interface once you have the public key loaded. It checks the signature against the vendor’s public key and confirms the message came from them without tampering. The tool shows a clear success or failure notice. This matches the signing workflow described in the PGP basics: you use your private key to sign, and anyone with the public key verifies it.

Compare the fingerprint again if the verification fails or looks suspicious. The out-of-band check you already performed prevents exactly the fake-key scenario. In market terms, a vendor signature on the final address confirmation or escrow release gives you concrete proof the message originated from them. Without the signature, you risk accepting unverified claims that could lead to bad deals or hidden charges.

Decrypt the signed message if needed by selecting the vendor key and using the decrypt function. The private key unlocks both the content and the signature verification in one pass. The desktop hotkey still works here: copy the signed block, press the encrypt shortcut to trigger decrypt instead, and paste the result. This keeps your hands off the private key during normal use.

Decrypting Incoming Messages

When the vendor replies with their signed confirmation, copy the entire encrypted block. Go to the Keys tab or the main interface to decrypt. Select your own key from the list and click the decrypt option. The private key unlocks the message, revealing the vendor’s address confirmation and any signature details. The output appears in plain text once decrypted.

The process mirrors the encryption steps but runs in reverse. Paste the decrypted result into your notes or transaction log. Always verify the signature again after decryption to confirm no tampering occurred during transit. The entire flow stays local to your device, so no data leaves your browser or app.

Store the decrypted confirmation securely alongside your original encrypted address. This gives you a complete record of the vendor interaction without exposing anything on the wire. If the vendor later sends another signed update, repeat the same copy-paste-de