openpgp encrypt, sign, decrypt and verify: working versions (tested 2026-10-16)

{
  "name": "openpgp-encrypt-decrypt",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "openpgp": "6.3.2"
  },
  "devDependencies": {
    "@types/node": "26.6.5",
    "tsx": "4.23.15"
  }
}

import * as openpgp from "openpgp";
import type { PrivateKey } from "openpgp";

export type KeyPair = {
  publicKey: string;
  privateKey: string;
};

export type DecryptResult = {
  text: string;
  verified: boolean;
};

export async function generateKeyPair(passphrase: string, name: string, email: string): Promise<KeyPair> {
  const { privateKey, publicKey } = await openpgp.generateKey({
    type: "ecc",
    curve: "curve25519Legacy",
    userIDs: [{ name, email }],
    passphrase,
    format: "armored",
  });
  return { publicKey, privateKey };
}

export async function unlockPrivateKey(armoredKey: string, passphrase: string): Promise<PrivateKey> {
  const privateKey = await openpgp.readPrivateKey({ armoredKey });
  return openpgp.decryptKey({ privateKey, passphrase });
}

export async function encryptAndSign(text: string, publicKeyArmored: string, signingKey: PrivateKey): Promise<string> {
  const message = await openpgp.createMessage({ text });
  const encryptionKey = await openpgp.readKey({ armoredKey: publicKeyArmored });
  const armored = await openpgp.encrypt({
    message,
    encryptionKeys: encryptionKey,
    signingKeys: signingKey,
  });
  return armored as string;
}

export async function decryptAndVerify(
  armoredMessage: string,
  decryptionKey: PrivateKey,
  verificationKeyArmored: string,
): Promise<DecryptResult> {
  const message = await openpgp.readMessage({ armoredMessage });
  const verificationKey = await openpgp.readKey({ armoredKey: verificationKeyArmored });
  const { data, signatures } = await openpgp.decrypt({
    message,
    decryptionKeys: decryptionKey,
    verificationKeys: verificationKey,
  });
  const verified = signatures.length > 0 && (await signatures[0].verified);
  return { text: data as string, verified };
}

export async function signDetached(text: string, signingKey: PrivateKey): Promise<string> {
  const message = await openpgp.createMessage({ text });
  const armored = await openpgp.sign({
    message,
    signingKeys: signingKey,
    detached: true,
    format: "armored",
  });
  return armored as string;
}

export async function verifyDetached(
  text: string,
  armoredSignature: string,
  verificationKeyArmored: string,
): Promise<boolean> {
  const message = await openpgp.createMessage({ text });
  const signature = await openpgp.readSignature({ armoredSignature });
  const verificationKey = await openpgp.readKey({ armoredKey: verificationKeyArmored });
  const { signatures } = await openpgp.verify({
    message,
    signature,
    verificationKeys: verificationKey,
  });
  return signatures.length > 0 && (await signatures[0].verified);
}

import { test, before } from "node:test";
import assert from "node:assert/strict";
import type { PrivateKey } from "openpgp";
import {
  generateKeyPair,
  unlockPrivateKey,
  encryptAndSign,
  decryptAndVerify,
  signDetached,
  verifyDetached,
  type KeyPair,
} from "../src/pgp.ts";

const PASSPHRASE = "correct horse battery staple";

let alice: KeyPair;
let alicePrivate: PrivateKey;
let bob: KeyPair;

before(async () => {
  alice = await generateKeyPair(PASSPHRASE, "Alice", "[email protected]");
  alicePrivate = await unlockPrivateKey(alice.privateKey, PASSPHRASE);
  bob = await generateKeyPair(PASSPHRASE, "Bob", "[email protected]");
});

test("encrypts, signs, decrypts and verifies a message", async () => {
  const plaintext = "attack at dawn";
  const ciphertext = await encryptAndSign(plaintext, alice.publicKey, alicePrivate);
  const result = await decryptAndVerify(ciphertext, alicePrivate, alice.publicKey);
  assert.equal(result.text, plaintext);
  assert.equal(result.verified, true);
});

test("detached signature verifies against the original message", async () => {
  const plaintext = "detached payload";
  const signature = await signDetached(plaintext, alicePrivate);
  assert.equal(await verifyDetached(plaintext, signature, alice.publicKey), true);
});

test("detached signature does not verify with the wrong key", async () => {
  const plaintext = "detached payload";
  const signature = await signDetached(plaintext, alicePrivate);
  let verified = false;
  try {
    verified = await verifyDetached(plaintext, signature, bob.publicKey);
  } catch {
    verified = false;
  }
  assert.equal(verified, false);
});

test("wrong private key cannot decrypt", async () => {
  const ciphertext = await encryptAndSign("secret payload", alice.publicKey, alicePrivate);
  const bobPrivate = await unlockPrivateKey(bob.privateKey, PASSPHRASE);
  await assert.rejects(() => decryptAndVerify(ciphertext, bobPrivate, alice.publicKey));
});