Does bridges@torproject.org support OpenPGP?

Support Censorship Circumvention
1

I would like to request Tor bridge lines from a Gmail address and receive the reply encrypted to my OpenPGP public key
and digitally signed by the service.

Does bridges@torproject.org publish an official OpenPGP public key? If so, where can I find its verified fingerprint,
and how should I submit my public key?

If OpenPGP is not supported, what secure method should be used for requesting bridge lines by email?

I plan to copy the received bridge lines into Tor configuration.

2

I wouldn’t send your PGP public key to the bridge address unless Tor confirms they support it. Right now, the safer supported options are the Bridges website, Tor Browser’s built-in bridge request or the official Telegram bot.

3

Hi @Nokhrin

No, bridges@torproject.org does not support OpenPGP encryption or signing.

It is an automated distribution script designed specifically to parse incoming requests and auto-reply with bridge lines. Because it operates strictly as an automated bot, it does not process PGP signatures, read attached public keys, or publish an official PGP key for encrypting email responses.

If you are looking for secure or alternative ways to fetch bridge lines:

  1. Built-in Tor Browser Request (Recommended): The safest method is directly within Tor Browser via Settings > Connection > Bridges > Request a bridge from torproject.org (uses Domain Fronting / Moat).

  2. Telegram Bot: You can request bridges via the official Telegram bot @GetBridgesBot.

  3. Web Interface: Visit https://bridges.torproject.org over HTTPS.

Note: If you are sending an email request to bridges@torproject.org, keep in mind it currently requires sending from a Gmail or Riseup address to prevent bot abuse.

4

@Rutkulis
@Prince73

Thank you for the quick and detailed response!

I especially appreciate the list of all the ways to obtain bridge lines and the explanation of their
characteristics. I
have tried each of the suggested methods—the web interface, the request through Tor Browser, and the
Telegram bot—and
they all work as expected.

The issue is now resolved, but I would like to confirm: the method using the browser is indeed the
safest, as it
involves the fewest intermediaries (no need to go through an email service or the Telegram
platform).

Thanks again!