Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there flag or something in an openPGP key that can be used to communicate my wish that this key should never be uploaded to a keyserver?

If not, can I create a key that is broken in such a way that it won't be accepted by a keyserver, but can still be used for normal encrypt and signing operations?

I know this behaviour breaks many aspects of the web of trust but I don't like the idea of spammers gathering my E-mail address from public keyservers.

share|improve this question
up vote 1 down vote accepted

No, it is not possible, and there is no flag to indicate you don't want your key uploaded.

What you could do is:

  • Include such information in a UID, but you can't be sure nobody will upload it anyway (even by accident)
  • Use a "hidden" mail address like, but this will break automatic use of the correct mail address and spammers are possibly able to parse these
  • Not giving any mail address in your key. Same problems like when hiding it, but definitely nobody will be able to parse it. The key can be used for encryption/signing anyway, but expect hassles with OpenPGP clients.

Probably it is more easy to accept spam and filter it. With some advanced filters, you could use a separate mail address and filter out all mails not containing any OpenPGP-packets.

share|improve this answer

There's nothing you can do to prevent this, because there is nothing to stop someone creating a new key with your email address and uploading that (though PGP Global Directory does actually verify the email address by mailing it). Similarly there's nothing you can do to prevent someone posting your email address on a forum or putting it on a billboard.

I think a rogue acquaintance adding your key to a keyserver is probably one of the less likely ways of it getting onto a spammers list, but (in my opinion) the most effective way to prevent this would be a note alongside any way in which your publish your key explaining your wishes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.