{"slug": "keyoxide", "name": "Keyoxide", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 5, "warners": 0, "score": 3.796, "rising": 0.02, "first": "2025-11-13", "latest": "2026-08-17", "why": "use keyoxide which is a modern decentralized alternative to keybase", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 1, "compare": 0, "warn": 0}, "spark": [1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "use keyoxide which is a modern decentralized alternative to keybase", "kind": "", "icon": false, "domain": "keyoxide.org", "github_repo": null, "official_url": "https://keyoxide.org", "pricing": "", "aliases": ["Keyoxide"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 788455200, "item_id": 49278450, "url": "https://news.ycombinator.com/item?id=49278450", "by": "rglullis", "date": "2026-08-12", "version": null, "stance": "recommend", "quote": "Or instead of buying Keybase, they could fund", "excerpt": "Or instead of buying Keybase, they could fund https://keyoxide.org/?", "context": "", "use_case": "Decentralized identity proofs", "switched_from": "", "story": "Tailscale Traces Database Corruption to 16y/o SQLite WAL-Reset Bug"}, {"id": 763347041, "item_id": 47709190, "url": "https://news.ycombinator.com/item?id=47709190", "by": "lrvick", "date": "2026-04-09", "version": null, "stance": "recommend", "quote": "thanks to keyoxide", "excerpt": "You can call it dead, and yet, it is the only system signing internet infrastructure at scale right now because of Debian, Suse, Fedora, Arch, Gentoo, Ubuntu, Redhat, etc. It is very much alive for those use cases that need it most. If one of those keys was compromised or the people that hold them, most of the internet is backdoored. Except for things built on stagex, in which case you would have to compromise severa", "context": "", "use_case": "Verifying PGP key identity", "switched_from": "", "story": "Open Source Security at Astral"}, {"id": 757553424, "item_id": 47347089, "url": "https://news.ycombinator.com/item?id=47347089", "by": "wizzwizz4", "date": "2026-03-11", "version": null, "stance": "recommend", "quote": "Keyoxide still exists: https://keyoxide.org/.", "excerpt": "Keyoxide still exists: https://keyoxide.org/.", "context": "", "use_case": "", "switched_from": "", "story": "The dead Internet is not a theory anymore"}, {"id": 741257428, "item_id": 46328589, "url": "https://news.ycombinator.com/item?id=46328589", "by": "Imustaskforhelp", "date": "2025-12-19", "version": null, "stance": "recommend", "quote": "someone can use https://keyoxide.org/ and paste in their public key", "excerpt": "Although I enjoy the public key/private key ideas, If you wish to talk encrypted, one of the best ways to do such could be having signal if you don't mind centralization But if you want decentralization some options i can recommend are matrix,simplex,session etc. But to be honest, there is a good point that you raise about how to talk decentralized on bluesky well, one of the ideas that I can think of right now, is t", "context": "", "use_case": "", "switched_from": "", "story": "I have to give Fortnite my passport to use Bluesky"}, {"id": 734714930, "item_id": 45919683, "url": "https://news.ycombinator.com/item?id=45919683", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "Use keyoxide docs to establish keyoxide profile", "excerpt": "There are many ways to use PGP just as there are many ways to use openssl or any other cryptographic suite of tools. For most individuals seeking to establish a long term durable personal keychain they want others to be able to externally trust and verify easily, I would suggest the following, which is more or less what most people in my circles do: 1. Buy a smartcard with touch support such as a Nitrokey 3 2. Ideall", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["decentralized identity", "decentralized identity proofs", "verifying pgp key identity", "identity verification", "key discovery and attestation"], "compared": [{"slug": "age", "name": "age", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "gnupg", "name": "GnuPG", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pgp", "name": "PGP", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "qubes-os", "name": "Qubes OS", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=45825040", "title": "Switching from GPG to Age", "mentions": 7}, {"url": "https://news.ycombinator.com/item?id=49328911", "title": "Self hosted email continues to steeply decline", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49272832", "title": "Tailscale Traces Database Corruption to 16y/o SQLite WAL-Reset Bug", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47699181", "title": "Open Source Security at Astral", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47340935", "title": "The dead Internet is not a theory anymore", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46327818", "title": "I have to give Fortnite my passport to use Bluesky", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {"recommend": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1, "neutral": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 789279617, "item_id": 49329976, "url": "https://news.ycombinator.com/item?id=49329976", "by": "skeledrew", "date": "2026-08-17", "version": null, "stance": "neutral", "quote": "Like a Keyoxide-based[0] - or similar - setup that makes it virtually impossible for one to lose their online identity", "excerpt": "I've been using GMail roughly since it existed I think, and have thought on and off over the years about self-hosting. The notion scares me every time because with it comes thoughts of what would happen if I were to lose the domain name or server, or even if there was an outage at the \"wrong time\". And then there's also the idea of updating the 1 million+1 services, etc that I used it to sign up for. As much as I'm n", "context": "", "use_case": "decentralized identity", "switched_from": "", "story": "Self hosted email continues to steeply decline"}, {"id": 788455200, "item_id": 49278450, "url": "https://news.ycombinator.com/item?id=49278450", "by": "rglullis", "date": "2026-08-12", "version": null, "stance": "recommend", "quote": "Or instead of buying Keybase, they could fund", "excerpt": "Or instead of buying Keybase, they could fund https://keyoxide.org/?", "context": "", "use_case": "Decentralized identity proofs", "switched_from": "", "story": "Tailscale Traces Database Corruption to 16y/o SQLite WAL-Reset Bug"}, {"id": 763347041, "item_id": 47709190, "url": "https://news.ycombinator.com/item?id=47709190", "by": "lrvick", "date": "2026-04-09", "version": null, "stance": "recommend", "quote": "thanks to keyoxide", "excerpt": "You can call it dead, and yet, it is the only system signing internet infrastructure at scale right now because of Debian, Suse, Fedora, Arch, Gentoo, Ubuntu, Redhat, etc. It is very much alive for those use cases that need it most. If one of those keys was compromised or the people that hold them, most of the internet is backdoored. Except for things built on stagex, in which case you would have to compromise severa", "context": "", "use_case": "Verifying PGP key identity", "switched_from": "", "story": "Open Source Security at Astral"}, {"id": 757553424, "item_id": 47347089, "url": "https://news.ycombinator.com/item?id=47347089", "by": "wizzwizz4", "date": "2026-03-11", "version": null, "stance": "recommend", "quote": "Keyoxide still exists: https://keyoxide.org/.", "excerpt": "Keyoxide still exists: https://keyoxide.org/.", "context": "", "use_case": "", "switched_from": "", "story": "The dead Internet is not a theory anymore"}, {"id": 741257428, "item_id": 46328589, "url": "https://news.ycombinator.com/item?id=46328589", "by": "Imustaskforhelp", "date": "2025-12-19", "version": null, "stance": "recommend", "quote": "someone can use https://keyoxide.org/ and paste in their public key", "excerpt": "Although I enjoy the public key/private key ideas, If you wish to talk encrypted, one of the best ways to do such could be having signal if you don't mind centralization But if you want decentralization some options i can recommend are matrix,simplex,session etc. But to be honest, there is a good point that you raise about how to talk decentralized on bluesky well, one of the ideas that I can think of right now, is t", "context": "", "use_case": "", "switched_from": "", "story": "I have to give Fortnite my passport to use Bluesky"}, {"id": 734714930, "item_id": 45919683, "url": "https://news.ycombinator.com/item?id=45919683", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "Use keyoxide docs to establish keyoxide profile", "excerpt": "There are many ways to use PGP just as there are many ways to use openssl or any other cryptographic suite of tools. For most individuals seeking to establish a long term durable personal keychain they want others to be able to externally trust and verify easily, I would suggest the following, which is more or less what most people in my circles do: 1. Buy a smartcard with touch support such as a Nitrokey 3 2. Ideall", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}, {"id": 734712640, "item_id": 45919540, "url": "https://news.ycombinator.com/item?id=45919540", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "Meanwhile with solutions like keyoxide, anyone can form confidence my key is mine trivially", "excerpt": "> In what situations do you want people to discover your key Just to name some of the most common use cases I have: 1. When people in my orgs want to encrypt sensitive information to me, e.g in encrypted password databases over git. 2. When prospective new clients or security researchers want to encrypt sensitive requests to me via email. Have some in my inbox right now from today. 3. When people want to verify that ", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}, {"id": 734710947, "item_id": 45919434, "url": "https://news.ycombinator.com/item?id=45919434", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "Keyoxide are much better ways to discover and distribute keys and signatures now", "excerpt": "Barely. Age has Yubikey support with no reasonable long term key discovery, backup, or rotation strategy as far as I can tell. All things modern PGP tooling supports. But this is what happens when people try to re-invent the wheel without thinking through all the problems the original solution solved. Also I do put these systems to the test, regularly, and rest billions of dollars of infrastructure on them. Anyone is", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}, {"id": 734686832, "item_id": 45917927, "url": "https://news.ycombinator.com/item?id=45917927", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "Just to name a few of the projects I work on, use, or find most interesting", "excerpt": "Just to name a few of the projects I work on, use, or find most interesting: https://keyoxide.org/ https://git.distrust.co/public/keyfork https://git.distrust.co/public/airgap https://codeberg.org/heiko/openpgp-pkcs11 https://codeberg.org/openpgp-card/openpgp-card-tools https://sequoia-pgp.org/ https://github.com/rpgp/rpgp https://www.nitrokey.com/news/2021/new-nitrokey-3-nfc-usb-c-rust-common-criteria-eal-6 https://", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}, {"id": 734672225, "item_id": 45917014, "url": "https://news.ycombinator.com/item?id=45917014", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "especially when combined with smartcards and keyoxide", "excerpt": "> When you worked with those cryptographers, did any of them stick up for PGP? Which ones? I'm not making up the attitude I'm describing. I am not going to drag anyone else or their reputations into this conversation but they can chime in if they want to. The general vibe I get about PGP among the cryptography engineers in my universe, that I share, is that it is an awkward spec that would have never been designed to", "context": "", "use_case": "Identity verification", "switched_from": "", "story": "Switching from GPG to Age"}, {"id": 734646241, "item_id": 45915390, "url": "https://news.ycombinator.com/item?id=45915390", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "use keyoxide which is a modern decentralized alternative to keybase", "excerpt": "Abusing ssh for signing is a silly thing to do in most cases when modern PGP tooling covers this and so many other use cases with established standards. Also, again, use keyoxide which is a modern decentralized alternative to keybase. You can vouch for yourself to bootstrap trust.", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}, {"id": 734643443, "item_id": 45915215, "url": "https://news.ycombinator.com/item?id=45915215", "by": "lrvick", "date": "2025-11-13", "version": null, "stance": "recommend", "quote": "make your key easy to discover without impersonation using keyoxide", "excerpt": "Age only covers encryption. It does not cover signing, ssh, web of trust, hierarchical keys, key discovery, etc. It is in no way a replacement for a modern PGP keychain. Ignore GnuPG which is a shit show stuck in the 90s. PGP != GPG For a modern long lived personal PGP keychain use Keyfork on AirgapOS which gives you a secure 24 word mnemonic backup, optional split backup across redundant smartcards, and a separation", "context": "", "use_case": "key discovery and attestation", "switched_from": "", "story": "Switching from GPG to Age"}]}