The modern successor to classic PGP ideas. Encrypt files and messages with today's cryptography — local keys, no cloud, no excuses.
INTRO LAUNCH PRICE · £2.99 · one-time · yours forever
Default email is postcard-level privacy. Cloud sync reads everything. “End-to-end” often means someone else’s keys. If you care about confidentiality, you need local, verifiable crypto — not vibes.
SMTP in the clear, providers that index your life, and attachments that travel unprotected. Assume the wire is hostile.
Sharing a link ≠ encrypting a file. If their servers hold the plaintext, your threat model already lost.
Classic tools carried RSA, IDEA, and packet formats from another era. The ideas were right. The primitives needed an upgrade.
VGP is a focused CLI: generate identities, encrypt to a recipient’s public key, authenticate with signatures, verify fingerprints. Private by design — no keyservers, no telemetry, no account.
Ed25519 for signing. X25519 for encryption. Separate long-term identity from session secrecy — the classic model, done right.
Only their private key opens it. Optional sender signature so they know it really came from you.
Sign releases, contracts, builds. Verify fingerprints like a pro. Armor that pastes cleanly into email.
Argon2id + AES-256-GCM wraps your private key. Your passphrase is the gate. We never see it.
| Layer | VGP choice | Why |
|---|---|---|
| Signing | Ed25519 | Fast, small, modern signature standard |
| Key agreement | X25519 | Ephemeral-static ECDH for forward secrecy on the wire |
| Payload | AES-256-GCM | Authenticated encryption — no plaintext malleability |
| Private-key KDF | Argon2id | Memory-hard; resists GPU cracking of passphrases |
| Container | VGPMSG1 | Original format — not OpenPGP packets |
Same job — encrypt for someone, prove it was you — with primitives you’d pick in a new design. Not OpenPGP-compatible on purpose.
VGPMSG1 + ASCII armor — not OpenPGP packets / GnuPGNeed to talk to existing PGP/GnuPG users? Stick with OpenPGP. VGP is a fresh private channel. More detail in the About page and FAQ.
Install once. Generate keys. Encrypt forever. No account, no cloud dependency.
One command creates your identity (sign) and encryption keypair, passphrase-wrapped.
vgp keygen --name "You" \ --email [email protected] --out ./keys
Use their public key. Optionally sign so they can verify it was you.
vgp encrypt --to bob.pub.vgp \ --in secret.txt --out secret.vgp \ --sign you.sec.vgp
Only their private key unlocks it. Signature check confirms the sender.
vgp decrypt --key bob.sec.vgp \ --in secret.vgp --out secret.txt \ --verify you.pub.vgp
No subscription. No seats. No “pro tier” upsell. Buy once, download, encrypt.
Intro launch price · one-time personal license · version 0.1.0+
vgp CLI (macOS / Linux / Windows via Python)Checkout uses Stripe Payment Link (configure in CONFIG.js).
Already purchased? Open download page
· Demo unlock: ?license=DEMO
VGP keeps the ideas (public-key encrypt, sign, local keys) and upgrades the crypto:
See also What VGP changes and About.
No. VGP is an independent product. PGP is a trademark of its respective owners. VGP is not affiliated with or endorsed by Phil Zimmermann, Network Associates, Symantec, or any official PGP® product. We share the spirit of private communication — not the codebase or brand.
No. VGP uses an original VGPMSG1 container and modern primitives (Ed25519 / X25519 / AES-256-GCM). It does not speak OpenPGP packets. Interop with GnuPG is intentionally out of scope.
On your machine, in files you control (.pub.vgp / .sec.vgp). Private keys are wrapped with Argon2id + AES-256-GCM under your passphrase. We never receive your keys or passphrase.
A personal license to use VGP, plus downloadable source zip, Python wheel, and install.sh. After purchase you’ll land on the download page (or use a license code). For demos, ?license=DEMO unlocks the same artifacts.
The £2.99 intro launch price is a personal license. For team / commercial licensing, contact the operator of https://vgprivacy.com. The underlying MIT-licensed source remains MIT for the open package — the paid license funds the product and branded distribution.
Version 0.1.0 is a clean-room design using well-known libraries (cryptography, argon2-cffi). Treat early versions as research-grade for high-stakes threat models until you complete your own review or a third-party audit.