The local part of the address is lowercased, hashed with SHA-1 and encoded in z-base-32, giving a 32-character name. In the advanced method the key is fetched from https://openpgpkey.example.org/.well-known/openpgpkey/example.org/hu/ followed by the hash and ?l= plus the local part; the direct method uses https://example.org/.well-known/openpgpkey/hu/ followed by the hash. The file is the binary key, and a policy file in the same directory signals that the domain supports WKD.
WKD ties key discovery to control of the domain and its WebPKI certificate rather than to a keyserver, and GnuPG (gpg --locate-keys), Thunderbird, Proton Mail, Mailvelope and others query it. gpg --with-wkd-hash -k user@example.org prints the hashed name to publish.