The modern successor to classic PGP ideas. Encrypt files and messages with today's cryptography — local keys, no cloud, no excuses.
Personal license £29 · one-time · yours forever
Default email is postcard-level privacy. Cloud sync reads everything. “End-to-end” often means someone else’s keys. If you care about confidentiality, you need local, verifiable crypto — not vibes.
SMTP in the clear, providers that index your life, and attachments that travel unprotected. Assume the wire is hostile.
Sharing a link ≠ encrypting a file. If their servers hold the plaintext, your threat model already lost.
Classic tools carried RSA, IDEA, and packet formats from another era. The ideas were right. The primitives needed an upgrade.
VGP is a focused CLI: generate identities, encrypt to a recipient’s public key, authenticate with signatures, verify fingerprints. Private by design — no keyservers, no telemetry, no account.
Ed25519 for signing. X25519 for encryption. Separate long-term identity from session secrecy — the classic model, done right.
Only their private key opens it. Optional sender signature so they know it really came from you.
Sign releases, contracts, builds. Verify fingerprints like a pro. Armor that pastes cleanly into email.
Argon2id + AES-256-GCM wraps your private key. Your passphrase is the gate. We never see it.
| Layer | VGP choice | Why |
|---|---|---|
| Signing | Ed25519 | Fast, small, modern signature standard |
| Key agreement | X25519 | Ephemeral-static ECDH for forward secrecy on the wire |
| Payload | AES-256-GCM | Authenticated encryption — no plaintext malleability |
| Private-key KDF | Argon2id | Memory-hard; resists GPU cracking of passphrases |
| Container | VGPMSG1 | Original format — not OpenPGP packets |
Install once. Generate keys. Encrypt forever. No account, no cloud dependency.
One command creates your identity (sign) and encryption keypair, passphrase-wrapped.
vgp keygen --name "You" \ --email [email protected] --out ./keys
Use their public key. Optionally sign so they can verify it was you.
vgp encrypt --to bob.pub.vgp \ --in secret.txt --out secret.vgp \ --sign you.sec.vgp
Only their private key unlocks it. Signature check confirms the sender.
vgp decrypt --key bob.sec.vgp \ --in secret.vgp --out secret.txt \ --verify you.pub.vgp
No subscription. No seats. No “pro tier” upsell. Buy once, download, encrypt.
One-time personal license · version 0.1.0+
vgp CLI (macOS / Linux / Windows via Python)Checkout uses Stripe Payment Link (configure in CONFIG.js).
Already purchased? Open download page
· Demo unlock: ?license=DEMO
No. VGP is an independent product. PGP is a trademark of its respective owners. VGP is not affiliated with or endorsed by Phil Zimmermann, Network Associates, Symantec, or any official PGP® product. We share the spirit of private communication — not the codebase or brand.
No. VGP uses an original VGPMSG1 container and modern primitives (Ed25519 / X25519 / AES-256-GCM). It does not speak OpenPGP packets. Interop with GnuPG is intentionally out of scope.
On your machine, in files you control (.pub.vgp / .sec.vgp). Private keys are wrapped with Argon2id + AES-256-GCM under your passphrase. We never receive your keys or passphrase.
A personal license to use VGP, plus downloadable source zip, Python wheel, and install.sh. After purchase you’ll land on the download page (or use a license code). For demos, ?license=DEMO unlocks the same artifacts.
The £29 tier is a personal license. For team / commercial licensing, contact the operator of https://vgprivacy.com. The underlying MIT-licensed source remains MIT for the open package — the paid license funds the product and branded distribution.
Version 0.1.0 is a clean-room design using well-known libraries (cryptography, argon2-cffi). Treat early versions as research-grade for high-stakes threat models until you complete your own review or a third-party audit.