What is PGP Web of Trust?
A decentralized trust model where PGP users verify each other's identities and sign each other's public keys, creating a network of trust without a central authority.
The Web of Trust is PGP's alternative to the Certificate Authority model used by TLS.
How It Works
- Users meet in person and verify each other's identities
- They sign each other's PGP public keys
- If Alice trusts Bob, and Bob has signed Carol's key, Alice may decide to trust Carol's key
- Trust is transitive to a configurable depth
Problems
- Requires in-person key signing (doesn't scale)
- Complex for non-technical users
- Key servers were never designed for key revocation/deletion
- Email addresses in public keys are harvestable
- The web of trust graph itself reveals social connections (metadata)
Modern Alternatives
- Keybase: Linked social media proofs for key verification (acquired by Zoom)
- keys.openpgp.org: Privacy-respecting key server (email verification)
- Signal: Automatic key management — users never interact with keys directly
Current Status
The PGP Web of Trust is largely abandoned. Modern encrypted messaging (Signal) has shown that usable encryption doesn't require users to manage keys manually.
Related Terms
Certificate Authority
An organization trusted to issue digital certificates that verify the identity of websites, enabling HTTPS encrypted connections.
PGP
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. It's used for signing, encrypting, and decrypting texts, emails, files, and directories, and is the gold standard for email encryption.
Public Key Cryptography
A cryptographic system that uses pairs of keys: public keys (which may be disseminated widely) and private keys (which are known only to the owner). This enables secure communication between parties who have never met and forms the basis for digital signatures, key exchange, and encrypted communication.
Have more questions?
Use our guided flow to get the right next privacy step for PGP Web of Trust.
Open Guided Flow