PGPy

What it is and what it does

PGPy is a pure-Python implementation of the OpenPGP standard (RFC 4880), allowing you to work with PGP keys, signatures, and encrypted messages within Python applications. It handles loading keys in ASCII-armored and binary formats, creating and verifying signatures with RSA, DSA, and ECDSA algorithms, and encrypting/decrypting data using RSA and ECDH. The library requires Python >= 3.6 and depends on the cryptography, pyasn1, and six packages.

The project is currently dormant: the last release was 2022-11-24, and there have been no commits or updates for over 1359 days. While the repository is not archived and has 344 stars, the lack of active maintenance means security patches and compatibility fixes are unlikely. The library is classified as Beta (Development Status :: 4), reflecting its maturity level but also suggesting caution for production use without independent security review.

Use it for:

• Load and parse existing PGP keys and signatures from files or external sources for verification workflows.
• Create and verify digital signatures on documents or data using RSA, DSA, or ECDSA algorithms.
• Encrypt messages with RSA or ECDH and decrypt them within a Python application.
• Build custom cryptographic workflows that require OpenPGP compliance without external GPG/GnuPG binaries.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

PGPy implements OpenPGP (RFC 4880) in pure Python, enabling you to load, create, and verify RSA, DSA, and ECDSA signatures, and encrypt/decrypt messages using RSA and ECDH.

No, unless you have a specific legacy requirement. The package is dormant (last release 2022-11-24, no commits in 1359+ days), so it will not receive security updates or compatibility fixes for modern Python or cryptography versions. For new projects, use actively maintained alternatives like python-gnupg or cryptography directly. If you must use PGPy, audit its OpenPGP implementation independently and isolate it in a controlled environment.

Install

pgpy on PyPI

pip install pgpy

uv add pgpy

poetry add pgpy

Installing PGPy

Before you install

Installation friction is high: the package has no runtime dependencies listed in the fact sheet, yet the description notes requirements for cryptography, pyasn1, and six. The project is dormant—last release was 2022-11-24, over 1359 days ago—so expect no active maintenance or security updates.

License in practice

BSD-3-Clause is permissive, allowing commercial and private use with minimal restrictions. You must include a copy of the license and acknowledge the original authors, but there are no copyleft obligations.

Quickstart

pip install PGPy

from pgpy import PGP

# Load a key or create signatures/encrypt messages
# (See https://pgpy.readthedocs.io/en/latest/ for full API)

Requires Python >= 3.6; cryptography, pyasn1, and six must be installed as dependencies.

Verify before relying

• Whether the listed dependencies (cryptography, pyasn1, six) are correctly declared in the package metadata, given the discrepancy between the fact sheet and description.
• Current compatibility with modern Python versions (3.10+) and recent cryptography library releases, given the dormant maintenance status.
• Whether the package's OpenPGP implementation remains compliant with RFC 4880 or any subsequent updates.

Package facts

Evidence: PGPy-0.6.0.tar.gz

Keywords: OpenPGP, PGP, Pretty Good Privacy, GPG, GnuPG, openpgp, pgp, gnupg, gpg, encryption, signature

Tags

More Libraries packages