A PGP private key block, and one word

An armoured block whose marker lines say it carries secret key material rather than public.

The shape

Structurally there is nothing new. The container is the one described on the family page: markers, optional fields, a separator, a base64 body, an optional checksum, a closing marker. The single distinguishing feature is the word PRIVATE sitting where PUBLIC would be.

Distinguishing word: PRIVATE, in the marker lines, both of them
Older wording: some software writes SECRET KEY BLOCK for the same thing
Everything else: identical to the container described on the family page
Body appearance: base64, indistinguishable by eye from any other armoured body
Typical length: usually longer than the public block from the same key, though length is a poor marker

-----BEGIN PGP PRIVATE KEY BLOCK-----

[body: 52 lines of base64 characters, removed here]
=xxxx
-----END PGP PRIVATE KEY BLOCK-----

Shown so the shape is recognisable. No private key material appears on this site in any form.

Read that first line beside its public counterpart and the difference is seven characters in the middle of an otherwise identical string. At a glance, in a small font, in a scrolling window, the two lines are the same line. That is not a design flaw so much as a fact about how the names were chosen, and it has a practical consequence covered below.

The block that circulates

-----BEGIN PGP PUBLIC KEY BLOCK-----

The block that should not

-----BEGIN PGP PRIVATE KEY BLOCK-----

One word, in the same position, in lines of near identical length. Everything either side of it matches.

When one of these arrives

There is no ordinary situation in which a private key block travels between two people. It is not exchanged, not published, not attached to an introduction and not requested. So the correct reading of one landing in front of you is not that you have received something valuable; it is that something has gone wrong upstream of you, and the block is the symptom.

Two ordinary explanations account for most of it. Somebody exported both halves of a key at once and copied the wrong region of the resulting text, which is easy when the two headers differ by one word and the bodies below them look the same. Or somebody is presenting a private key block as proof of something, in which case the presentation is the thing to look at, not the block.

This card describes the shape only. It offers no procedure for handling one, and none is implied by anything above.

How to check it by eye

One word, read twice

Read the fifth word of the first line before you read anything else. PUBLIC or PRIVATE, or on older output SECRET.
Read the same word in the closing line. A block whose two markers disagree is a block assembled from two different sources.
Note the position where the word sits: it is always after BEGIN PGP and before KEY BLOCK, never anywhere else.
If the text arrived as one continuous run with no line breaks, find the word anyway. It survives even when the layout does not.

What a wrong shape means

A malformed private key block carries the same transport story as any other armoured text, and the diagnosis is no different from the public case. The unusual reading is the opposite one: a perfectly formed private key block, arriving cleanly, is the shape that should stop you, because correctness here is not reassuring. Nothing about a broken one makes it safer and nothing about an intact one makes it appropriate.

One specific mismatch is worth naming. If the opening line says PRIVATE and the closing line says PUBLIC, or the reverse, then somebody has pasted across a boundary in a file that held both. That is a copying accident with a very clear signature, and it says something about how the text was assembled rather than about who assembled it.

Two blocks stacked in one file

The reason those crossed markers happen is that software will happily write both halves of a key into a single file, one after the other, with no separation beyond the marker lines themselves. Laid out on screen it looks like this.

Two complete blocks, touching. The join between them is a single line break, and both bodies look the same from a distance.

Scrolled through at speed, that file is a wall of base64 with four short lines in it. The boundary between the two blocks is one line change out of ninety odd, and the two words that distinguish them sit in the middle of lines that are otherwise the same length and the same shape. Somebody dragging a selection to copy the public half can very easily start above the wrong marker or release below it.

This card describes that layout because it explains, without any suspicion being necessary, how the wrong block ends up somewhere it should never have gone. When you see a private key block arrive, a file like the one above is usually behind it.

What a correct shape does not prove

The format tells you the container is well built. On its contents it is silent, and on its provenance it is worse than silent, because a clean block invites an assumption it cannot support.

Not that the material inside is usable. Secret key material can be locked behind a passphrase, and a locked one and an unlocked one are the same shape.
Not that it pairs with any public key you have seen. The two halves are related mathematically, not visually.
Not that the sender was careless. A block offered deliberately looks exactly like a block sent by mistake.
Not that it is real key material at all. The body is base64, and base64 will encode anything, including nothing in particular.
Not that it belongs to whoever the surrounding text says it belongs to. Surrounding text is just text.

The shape check ends at the markers. Beyond them, this card claims nothing whatsoever, and the general form of that limit is set out at what a shape proves.

What this card is not

This is not guidance on storing, moving or destroying key material, and this site publishes none. It does not cover the public half, which is at a public key block, nor the checksum line at the foot of both, which is at the checksum line.

A PGP private key block