CryptoPad on Android: your first key, contact and message
This guide takes you from a freshly installed app to your first encrypted message and back: make your own key, give its public part to someone, add their public key as a contact, encrypt a message for them and decrypt one sent to you. It takes about five minutes.
The screenshots show CryptoPad on Android 14. The app has three tabs at the bottom — Settings, Contacts and Pad — and you can also move between them by swiping left or right. It always opens on Settings.
1. Make your key
On Settings, type a name for the key in Key Name — for example My phone. A name is 2 to 50 characters: letters and digits in any alphabet, spaces, dots, dashes, underscores, apostrophes (as in O’Neill) and middle dots. Anything else — @, !, slashes, emoji and so on — is refused with “Name contains invalid characters”.
Then choose the key type with the arrow on the right of the button. RSA is the default; NIST and X25519 are the other two. Any of them works — the key guide explains the difference. The button's text follows your choice (Generate RSA Key, Generate NIST Key or Generate X25519 Key), and the app remembers the type you picked last.
On Android 12 and older the third option reads X25519 (Android 13+) and cannot be chosen; use RSA or NIST there.
Tap the button. An RSA key takes a few seconds (“Generating key pair...”); the other two are ready at once. The new key appears under Your Keys.
The key never leaves the phone. What the app copies is only its public part; the private part is stored encrypted on the phone and is never shown or copied out.
2. Send your public key
Open the ⋮ menu next to your key and tap Copy Public Key. The app confirms with “Public key copied”. Paste it into any messenger or email to the people who will write to you.
The public key is safe to send openly: all it can do is lock messages for you. It is a block of text that starts with -----BEGIN PUBLIC KEY----- and ends with -----END PUBLIC KEY----- — send all of it, those two lines included.
3. Add a contact
Ask the person you will write to for their public key, and copy it on your phone. Then open Contacts and tap Add Contact (on an empty list, Add First Contact does the same).
In the dialog, type their name in Contact Name, tap Paste from Clipboard to put their key into Public Key (PEM), and tap Add. Contact names follow the same rules as key names, and two contacts cannot share a name.
Before you rely on a contact, make sure the key really is theirs: compare it with them through another channel — side by side when you meet, or a long stretch from the middle of it read aloud on a call. Not the first or last lines: those look alike for every key of the same type. The key guide says why this matters.
4. Choose who the message is for
Each contact has a round button on the left. The filled one, on a tinted row, is the recipient: the person the next message is encrypted for. Tap a contact to choose it. A contact you have just added is chosen automatically.
The choice is not kept when the app is closed, so check it before you encrypt. Search contacts at the top of the list finds a contact by name.
5. Encrypt a message
Open Pad and type your message in Enter plain/cipher text. Tap Encrypt. The line under the buttons says who it was encrypted for — “Encrypted for Alice” — and the encrypted text appears in Output.
Tap Copy Output and paste the result into any chat or email to that person. It is one long line of letters, digits and a few symbols (+, /, =); send it whole, in one message. Only the holder of Alice's key can open it — once it is encrypted, not even you can.
Encrypt stays grey until a recipient is chosen and there is some text on the Pad. When no recipient is chosen, the Pad says so in red: “Select a recipient in Contacts tab to encrypt messages”.
6. Decrypt a message sent to you
Copy the encrypted message you received. On Pad, tap Paste Input — it replaces whatever is in the field — and then Decrypt. The readable text appears in Output, and the line above it says which of your keys opened it: “Decrypted for My phone”.
You do not pick a key for this: CryptoPad tries every key you have. Decrypt stays grey until you have a key of your own; with none, the Pad says “Generate a key in Settings tab to decrypt messages”. Clear empties both fields when you are done.
7. Find and delete
Search contacts keeps only the contacts whose name contains what you type. To delete a contact or a key, open its ⋮ menu and tap Delete. The app asks first, and a deletion cannot be undone.
Deleting a key is final. Messages encrypted for it can no longer be opened, by anyone. If you make a new key, send your contacts its public part again.
8. When something goes wrong
- “Invalid key format: missing BEGIN PUBLIC KEY” (or END PUBLIC KEY) — what was pasted as the contact's key is not a whole public key. Ask for it again and copy all of it, both marker lines included.
- “Decryption failed: no matching key for this message” — the message was not encrypted for any of your keys (perhaps for a key you deleted, or for someone else), or it was cut or changed on the way. Ask the sender which of your public keys they used, and to send the message again in one piece.
- “Input must be base64-encoded” — what is on the Pad is not a whole encrypted message: often it was cut short, or only part of it was copied. Ask for it again, in one piece.
- “Contact with this name already exists” or “Key with this name already exists” — names must differ, whatever the capital letters. The dialog closes (or the Key Name field is cleared), so start again with another name; for a contact, copy their key again first.
More answers are on the Support page.