Eight shapes share one wrapper. This page describes the wrapper, then says where each member of the family parts company with it. Nothing here checks whether any key is genuine; that limit is set out on what a shape proves.
A key, a signature and an encrypted payload are binary underneath. None of them survive being pasted into a message box, a forum reply or a profile field in that form. ASCII armour is the wrapper that makes them survivable. It encodes the binary as base64 text and fences the result between two marker lines, so that a reader, or a program, can see where the thing begins and where it ends.
The wrapper is a container. It carries whatever it is handed, and it looks the same either way. That is the most useful single fact in this family, because the same skeleton holds a public key you asked for, a private key nobody had any business sending you, and payloads that are not keys at all.
The skeleton every block shares
Six parts, in a fixed order. Only one of them changes from member to member.
- Header line
- five hyphens,
BEGIN PGP, the block name, five hyphens - Header fields
- zero or more lines shaped
Name: value - Separator
- one blank line, between the last field and the first body line
- Body
- base64 text, wrapped at a fixed width, with no spaces in it
- Checksum
- an optional line beginning
=, described at the checksum line - Footer line
- the header line again, with
ENDwhereBEGINwas
-----BEGIN PGP BLOCK NAME-----
Comment: an optional field, any text after the colon
[body: NN lines of base64 characters, removed here]
=xxxx
-----END PGP BLOCK NAME-----x characters standing for four base64 characters.The header line and the footer line must agree word for word. The hyphen runs are five long on both sides of both lines; four is wrong and six is wrong, and neither is a judgement call. The field lines above the body are free text after the colon, which means they carry no weight at all: a field can say anything, because whoever produced the block typed it.
The blank line is the part that gets lost. It is a structural separator, not decoration, and comment boxes that collapse empty lines remove it without asking. When a block will not open, the missing empty line is one of the first things worth looking for.
Where the members differ
The block name is the only variable in the marker lines, and it is not a description of what is inside so much as a label for the container.
| Block name in the marker line | What the container is carrying |
|---|---|
| PGP PUBLIC KEY BLOCK | a public key and the material attached to it |
| PGP PRIVATE KEY BLOCK | secret key material, and a word away from the line above |
| PGP SIGNATURE | a signature, whether detached or closing a clear signed message |
| PGP MESSAGE | several unrelated payloads share this one name |
| PGP SIGNED MESSAGE | the only member with readable text inside the fence |
Two members of this family are not armoured blocks at all. A fingerprint and a key id are short runs of hex that describe a key rather than carry one, and they turn up printed beside a block, quoted in a message, or written down on their own. They sit here because that is where you meet them.
- A PGP public key blockThe marker lines, the blank line, the base64 body and the closing line, taken one at a time
- A PGP private key blockThe same container as a public key block, with the one word that changes what it holds
- A clear signed messageReadable text between an opening marker and a signature block, with an escape rule of its own
- A detached signature blockA signature with no message inside it, and the filename convention that ties it to one
- A PGP encrypted blockThe least specific marker in the family, shared by several unrelated kinds of payload
- A key fingerprintForty hex characters, usually in ten groups of four, with several printed forms
- A short key id and a long key idEight characters or sixteen, cut from the end of a forty character fingerprint
- The checksum line at the foot of an armoured blockAn equals sign and four base64 characters, alone on the line above the closing marker
What transport does to these blocks
Armoured text is designed to be copied, and copying is where it gets damaged. The damage is not random. It falls into a small number of recognisable patterns, and being able to name the pattern is most of the work.
- Line breaks removed, so the body arrives as one very long line. That shape has its own entry at a block that lost its line breaks.
- A quote character added to the front of every line by a reply, so each body line begins with a symbol that is not in the base64 alphabet.
- The blank separator swallowed by an editor that trims empty lines.
- A hyphen run rewritten as a single long dash by software that reformats punctuation. This site does not print that character anywhere, so you will not find an example of it here.
- The selection started or stopped a character early, taking a bite out of one marker line.
- The whole block cut off by a length limit, which usually leaves the footer missing entirely.
The wrong shapes above are indexed by what you actually see at wrong shapes. If you want the character sets themselves, base64 and hex both live on the alphabets page, and counting long strings without a tool is covered at counting by eye.