Privacy & Encryption Guide

What Is GPG?

GPG is one of the most widely used tools for working with OpenPGP encryption and digital signatures. Learn what it does, how keys work, how to create your own, and where you can use it in everyday applications.

Security Encryption OpenPGP Beginner Friendly Updated October 2026

The short answer

GPG, short for GNU Privacy Guard or GnuPG, is software that lets you encrypt information, decrypt information, create digital signatures, and manage cryptographic keys.

GnuPG is an implementation of the OpenPGP standard. OpenPGP defines the formats and cryptographic mechanisms used to exchange encrypted and signed information. GnuPG provides the tools that actually perform those operations.

This distinction is useful because people often use the terms GPG, GnuPG, PGP, and OpenPGP as though they mean exactly the same thing. They are related, but they are not identical.

The big picture

What Is GPG Used For?

OpenPGP provides several related security functions. You do not have to use all of them at once.

  1. 01

    Confidentiality

    Encrypt information

    Encryption transforms readable information into ciphertext that cannot be understood without the appropriate decryption key.

    • Encrypt files before storing or transferring them.
    • Encrypt email so only intended recipients can decrypt it.
    • Protect sensitive documents while they are in transit.
    Think of it as a locked box.

    You can give someone the means to lock a message for you without giving them the secret needed to unlock it.

  2. 02

    Authenticity

    Digitally sign information

    A digital signature allows someone to verify that a message or file was signed by the holder of a particular private key and that the signed data has not been changed.

    • Sign email messages.
    • Sign software releases and source code.
    • Sign documents or files.
    • Verify signatures made by other people or organizations.
    Encryption and signing are different.

    Encryption is primarily about confidentiality. Signing is about authenticity and integrity. A message can be signed without being encrypted, or encrypted and signed together.

  3. 03

    Key management

    Manage identities and cryptographic keys

    GPG also provides tools for creating, importing, exporting, inspecting, backing up, revoking, and otherwise managing OpenPGP keys.

    • Create your own key pair.
    • Import another person's public key.
    • Export your public key for others.
    • Check fingerprints and key information.
    • Create and use revocation certificates.

The foundation

How Public and Private Keys Work

GPG uses public-key cryptography. The most important concept to understand is that your public key and private key have different jobs.

Public and private key relationship A diagram showing a sender using a recipient's public key to encrypt information and the recipient using their private key to decrypt it. A B Sender Recipient Uses B's public key Uses B's private key ENCRYPTED Message Only B's private key can decrypt it Public keys can be shared. Private keys must remain private.
Simplified public-key encryption model: the recipient's public key can encrypt information for that recipient, while the matching private key is required for decryption.
  1. A

    Public key

    Safe to share

    Your public key is intended to be distributed. Other people can use it to encrypt information for you and to verify signatures made by your private key.

    Your public key is not a secret.

    You can publish it on a website, send it to contacts, attach it to an email, or publish it through an OpenPGP-compatible key discovery service.

  2. B

    Private key

    Protect it carefully

    Your private key, sometimes called your secret key, is the sensitive half of your key pair. It is used for operations such as decrypting information and creating digital signatures.

    Never send your private key to someone else.

    Keep protected backups. Use a strong passphrase and consider hardware-backed key storage for higher-security environments.

  3. C

    Fingerprint

    Verify the identity of a key

    A key fingerprint is a short representation derived from a public key. It gives people a practical way to compare whether they have the same key.

    When a key is important, compare its fingerprint through an independent trusted channel instead of simply trusting a key that appeared in an email or download.

Terminology matters

PGP, OpenPGP, GPG, and Key Versions

Several names and generations of technology are commonly grouped together. Understanding the differences prevents a lot of confusion.

01

PGP

The original product family

PGP originally referred to Pretty Good Privacy, software created by Phil Zimmermann. The name later became associated more broadly with the family of technologies used for PGP-style encryption and signing.

Today, people often use "PGP" informally when they actually mean OpenPGP-compatible encryption.

02

OpenPGP

The interoperable standard

OpenPGP defines the data formats and cryptographic mechanisms that compatible applications use to exchange encrypted and signed information.

The current Internet standards-track specification is RFC 9580, published in July 2024. It supersedes RFC 4880 and earlier OpenPGP specifications.

03

GnuPG / GPG

The software implementation

GNU Privacy Guard, usually written as GnuPG or GPG, is a free implementation of OpenPGP. It provides command-line tools, key-management facilities, an agent for handling private keys, and interfaces that other applications can use.

The current GnuPG development line in October 2026 is the 2.5 series. GnuPG 2.5.24 was released on September 23, 2026.

04

OpenPGP key versions

Version 4 versus Version 6

OpenPGP has evolved through multiple key and packet formats. Versions 2 and 3 are obsolete. Version 4 has been the dominant format for many years, but RFC 9580 now deprecates Version 4 and recommends that implementations generate Version 6 keys.

Compatibility can still matter.

A Version 6 key is the modern direction, but not every older OpenPGP application understands Version 6. Before choosing a key format for a mixed or older environment, check the software used by everyone who needs to communicate with the key.

05

Algorithms

RSA and elliptic-curve cryptography

OpenPGP has supported multiple cryptographic algorithms over its history. RSA remains widely encountered in existing OpenPGP keys, but RFC 9580 does not recommend generating new RSA keys.

Modern OpenPGP implementations are expected to support Ed25519 for signatures and X25519 for encryption. Older algorithms such as DSA and ElGamal are deprecated in the current specification.

Do not choose an algorithm solely from an old tutorial.

GPG's defaults and OpenPGP's recommendations change over time. When creating a new key, use the current version of your software and its current documentation rather than copying an old command from an outdated guide.

Your first key

How Are GPG Keys Generated?

Creating a key pair is a local operation. Your computer generates cryptographic key material, associates it with a user identity, and stores the resulting keys in your local key store.

  1. 1

    Identity

    Choose your user ID

    A typical OpenPGP user ID associates a name and email address with a key. For example:

    Example identity

    Your name and email

    Your Name <you@example.com>

    The email address is useful when applications need to determine which key belongs to a particular email identity. It does not, by itself, prove that the person controlling the key actually controls that email address.

  2. 2

    Cryptography

    GPG generates key material

    GnuPG uses cryptographic random data supplied by the operating environment to create the key material. The result is a public portion that can be shared and a private portion that must remain protected.

    Modern OpenPGP commonly uses a primary key for certification and signing together with subkeys for specific purposes such as encryption. This separation limits how often the primary key needs to be used.

  3. 3

    Protection

    Protect the private key

    GPG can protect the private key with a passphrase. The passphrase adds another layer of protection if someone obtains a copy of the private-key material.

    A password and a passphrase are not the same security boundary.

    Your operating-system account protects access to your computer. Your OpenPGP passphrase protects the private-key material itself. Use a strong, unique passphrase that you can reliably recover.

Beginner method

Generate a key interactively

The guided method is the easiest place to start because GnuPG presents the available options rather than requiring you to know every algorithm and key parameter in advance. 

gpg --full-generate-key

What happens next?

  • GPG asks which type of key you want to create.
  • It asks for key parameters supported by your installed version.
  • You provide your name and email address.
  • You choose an expiration period when prompted.
  • You protect the private key with a passphrase.
  • GPG creates the key pair and records it in your local key store.

The exact prompts and available algorithms can change between GnuPG releases. Do not assume that an old screenshot or tutorial reflects the choices offered by your current version.

Advanced / scripted method

Generate a key with one command

gpg --quick-generate-key "Your Name <you@example.com>" default default 2y

Breaking down the command

  • --quick-generate-key uses GPG's streamlined key-generation interface.
  • "Your Name <you@example.com>" creates the user ID.
  • default allows the installed GnuPG version to choose the current default algorithm.
  • The second default selects the default usage.
  • 2y requests an expiration period of two years.

Using default rather than hard-coding an algorithm can be useful for a current installation because GnuPG's defaults can evolve. For interoperability-sensitive environments, however, confirm the requirements of the applications and recipients before generating keys.

GPG command reference

Essential GPG Commands

You can perform most everyday OpenPGP tasks from the command line. These examples assume GnuPG is installed and available as gpg.

Inspect

List your public keys

gpg --list-keys

Shows public keys known to your local GPG key store.

Inspect

List your private keys

gpg --list-secret-keys

Shows secret/private keys managed by GnuPG. Treat output from secret-key management commands as sensitive operational information.

Verify identity

Display a key fingerprint

gpg --fingerprint "you@example.com"

Fingerprints are especially useful when verifying that a public key obtained through one channel matches the key expected through another trusted channel.

Share

Export your public key

gpg --armor --export "you@example.com" > public-key.asc

The --armor option creates ASCII-armored output, which is convenient for email, text files, websites, and copy-and-paste operations.

The resulting .asc file contains public key information, not your private key.

Encrypt

Encrypt a file for someone

gpg --encrypt --armor --recipient "recipient@example.com" document.txt

GPG uses the recipient's public key to protect the file. The recipient then uses the corresponding private key to decrypt it.

Decrypt

Decrypt an encrypted file

gpg --decrypt document.txt.asc > document.txt

GPG uses a matching private key from your local key store. Depending on how the file was encrypted, GPG may ask you for your private-key passphrase.

Sign

Create a detached signature

gpg --armor --detach-sign document.txt

This produces a separate signature file that can be distributed with the original file. Someone with your public key can verify that the signature matches.

Verify

Verify a signature

gpg --verify document.txt.asc document.txt

Verification checks whether the signature mathematically matches the supplied file and signing key. You should also verify that the public key itself belongs to the person or organization you expect.

Putting GPG to work

Using GPG With Common Applications

GPG is not normally something you "turn on" globally. Instead, applications integrate with OpenPGP directly, use a GnuPG backend, or provide an extension that adds OpenPGP functionality.

  1. 01

    Email

    Thunderbird

    Mozilla Thunderbird has built-in OpenPGP support. You can create or import a personal OpenPGP key, associate it with an email identity, and then sign or encrypt messages from within the email client.

    • Open your account's settings.
    • Find the End-to-End Encryption / OpenPGP settings.
    • Create a new key or import an existing one.
    • Associate the key with the appropriate email identity.
    • Obtain and verify the recipient's public key.
    • Enable signing and/or encryption when composing a message.
    Important:

    Thunderbird's built-in OpenPGP implementation manages its own OpenPGP keys rather than simply sharing GnuPG's normal local key store. If you need the same keys across applications, understand the application's import/export and smart-card options before assuming the key stores are synchronized.

  2. 02

    Email

    Microsoft Outlook on Windows

    Gpg4win provides GnuPG along with graphical tools such as Kleopatra and the GpgOL integration for Outlook. This allows OpenPGP operations to be performed from supported Outlook environments.

    • Install a current Gpg4win release.
    • Create or import your OpenPGP key in Kleopatra.
    • Configure GpgOL for your Outlook installation.
    • Import and verify recipients' public keys.
    • Use the OpenPGP controls when composing messages.
    Check your Outlook version first.

    Gpg4win's compatibility differs between classic Outlook and the newer web-based Outlook. Do not assume that instructions written for classic Outlook apply to the new Outlook application.

  3. 03

    Browser + Webmail

    Gmail, Outlook.com, Yahoo, and other webmail

    A normal webmail site does not automatically become OpenPGP-enabled simply because GnuPG is installed on your computer. Browser-based OpenPGP tools can bridge that gap.

    Mailvelope, for example, is a browser extension that integrates OpenPGP encryption into supported webmail services. It can manage keys itself or, in supported configurations, work with a locally installed GnuPG backend.

    • Install the extension from its official source.
    • Create or import your OpenPGP key pair.
    • Authorize the webmail domain you intend to use.
    • Import and verify recipients' public keys.
    • Use the extension's encryption and signing controls.
    Browser permissions matter.

    Encryption extensions may request broad browser permissions because they need to interact with the webmail interface. Review those permissions and restrict site access where the extension allows it.

  4. 04

    Files

    Encrypt documents and archives

    You do not need email to use GPG. One of its simplest uses is protecting files before sending or storing them. 

    gpg --encrypt --armor --recipient "recipient@example.com" sensitive.txt

    Graphical tools such as Kleopatra can provide the same functionality without requiring you to remember command-line syntax.

  5. 05

    Development

    Sign files, releases, and software artifacts

    Developers and software projects can use OpenPGP signatures to demonstrate that a downloaded artifact corresponds to a particular signing key and has not changed since it was signed.

    This is especially useful when distributing software, checksums, release archives, or other files where recipients need to verify authenticity.

    Verification is more than checking that a signature exists.

    A valid signature only tells you that the data matches the signing key. You still need a trustworthy way to determine that the key actually belongs to the claimed publisher.

  6. 06

    Messaging

    GPG is not normally how modern chat apps encrypt messages

    This is an important distinction. Applications such as modern end-to-end encrypted messaging platforms generally implement their own encryption protocols rather than asking users to manage GPG keys for every conversation.

    In other words, installing GPG does not automatically add encryption to your favorite messaging application.

    OpenPGP can still be useful for applications or communication systems that specifically support it, including specialized secure messaging, file-transfer, and developer workflows.

    Do not force GPG into an application that was not designed for it.

    Use the security architecture provided by the application unless its documentation specifically supports OpenPGP integration.

  7. 07

    Web development

    OpenPGP can also run directly in applications

    Developers do not necessarily need to invoke the GPG executable. Libraries such as OpenPGP.js implement the OpenPGP protocol in JavaScript and can be used in supported browser and server-side environments.

    This is useful when an application needs to implement OpenPGP functionality as part of its own interface.

    Application security still matters.

    Cryptography does not automatically make a web application secure. Key storage, browser security, JavaScript supply-chain security, authentication, and the application's overall threat model remain important.

The part people overlook

Managing Your Keys Safely

Generating a key is easy. Managing it correctly over several years is the more important part.

  1. 01

    Backup

    Keep a protected backup of your private key

    If your computer fails and your only copy of a private key disappears, you may lose the ability to decrypt information encrypted to that key.

    Back up before you need it.

    Store an encrypted backup somewhere physically or logically separate from your primary computer. Test that you can actually restore it.

  2. 02

    Revocation

    Keep your revocation certificate safe

    A revocation certificate provides a mechanism for declaring a key invalid if you can no longer trust it. For example, you may need to revoke a key after losing control of the private key.

    GnuPG normally creates a revocation certificate when a new key is generated. Keep that certificate somewhere secure and separate from your normal key files.

  3. 03

    Verification

    Verify other people's keys

    Finding a public key is not automatically the same thing as verifying its identity. An attacker could provide a key claiming to belong to someone else.

    For important communications, compare the key's fingerprint through another trusted communication channel.

  4. 04

    Expiration

    Understand key expiration

    OpenPGP keys can have expiration dates. Expiration can be useful for key lifecycle management, but it should not be treated as a substitute for revocation or private-key protection.

    Before changing or replacing an expiring key, make sure your contacts, applications, backups, and published public-key information are updated appropriately.

  5. 05

    Hardware

    Consider hardware-backed keys for higher security

    GnuPG supports smart cards and security tokens. Keeping sensitive private-key operations on dedicated hardware can reduce the exposure of key material on a general-purpose computer.

    This is especially relevant for administrators, developers signing software releases, journalists, organizations handling sensitive information, and other users with a higher-value private key.

The evolution

From PGP to Modern OpenPGP

The terminology becomes easier to understand when viewed as an evolution rather than as several unrelated technologies.

PGP

Pretty Good Privacy

Phil Zimmermann's original PGP software introduced the general public to practical public-key email encryption and digital signatures.

IETF

OpenPGP becomes a standard

The OpenPGP specification provided an interoperable format that independent implementations could use to exchange encrypted and signed information.

GPG

GNU Privacy Guard

GnuPG became a widely used free implementation of OpenPGP and developed into a broader cryptographic toolkit with key management, agents, smart-card support, and integration interfaces.

V6

Modern OpenPGP

RFC 9580, published in 2024, updates the OpenPGP standard and recommends Version 6 keys for new implementations while formally deprecating older key versions.

Know the boundaries

What GPG Does Not Protect

Encryption is powerful, but it is not a complete security system. Understanding its limits is just as important as understanding how it works.

  1. 01

    Endpoints

    A compromised computer can expose decrypted information

    If malware or an attacker controls your computer, they may be able to access information before it is encrypted or after it has been decrypted. GPG cannot make a compromised operating system trustworthy.

  2. 02

    Metadata

    Encryption does not hide everything

    Depending on the application and protocol, information such as email addresses, timestamps, message routing, file names, or other metadata may remain visible even when the message contents are encrypted.

  3. 03

    Identity

    A public key is not automatically proof of identity

    An attacker can create a key claiming to belong to someone else. Key verification and fingerprint checking are therefore important parts of the OpenPGP trust model.

  4. 04

    Human behavior

    Good cryptography cannot fix bad key management

    Accidentally publishing a private key, losing the only copy of a private key, failing to verify a recipient's key, or storing a passphrase insecurely can undermine otherwise strong cryptography.

Before you start

Your GPG Starter Checklist

If you are setting up OpenPGP for the first time, work through these basics before sending anything important.

  1. 1

    Create

    Generate your key pair

    Use a current OpenPGP implementation and follow its current recommendations for key generation.

  2. 2

    Protect

    Secure your private key

    Use a strong passphrase and maintain a protected backup.

  3. 3

    Backup

    Save your revocation certificate

    Store it somewhere safe and separate from your everyday key files.

  4. 4

    Verify

    Learn to check fingerprints

    Do this before trusting a key for particularly sensitive communication.

  5. 5

    Integrate

    Connect GPG to the applications you actually use

    Start with one workflow—such as encrypted email or file encryption— rather than attempting to deploy OpenPGP everywhere at once.

Keep going

GPG is only as useful as your key management.

Once you understand public keys, private keys, fingerprints, signatures, and encryption, the command line becomes much less intimidating. Start with one practical use case, protect your private key, and build from there.

Review the commands

The takeaway

GPG in Plain English

GPG gives you practical tools for using OpenPGP encryption and digital signatures.

Your public key is designed to be shared. Your private key is designed to remain under your control. Other people can use your public key to encrypt information for you, while your private key is used to decrypt it. Your private key can also create signatures that other people verify using your public key.

The most important distinction is that GPG itself is not the encryption standard. OpenPGP is the standard, and GnuPG is one implementation of it. This is why a Thunderbird installation, a browser extension, a Windows utility such as Gpg4win, and the GPG command line can potentially exchange OpenPGP-compatible messages even though they are different pieces of software.

Modern OpenPGP is continuing to evolve. RFC 9580 establishes Version 6 as the direction for new key generation, while compatibility with existing Version 4 infrastructure remains a practical consideration.

The three rules to remember

Share your public key. Protect your private key. Verify the identity of keys before trusting them for sensitive communication.

Further reading

Primary References

The technical portions of this guide are based primarily on the current OpenPGP specification and official documentation from GnuPG, Mozilla Thunderbird, Gpg4win, and OpenPGP.js.

01

IETF

RFC 9580 — OpenPGP

The current Internet standards-track specification for OpenPGP, including key formats, algorithms, encryption, signatures, and packet structures.

  • RFC-9580 Documentation
    • 02

    GnuPG

    GNU Privacy Guard Manual

    Official documentation for GnuPG, including key generation, encryption, signatures, key management, GPG Agent, smart cards, and other GnuPG components.

  • GNU Privacy Guard Manual
    • 03

    Mozilla

    OpenPGP in Thunderbird

    Official Thunderbird documentation covering built-in OpenPGP, key management, encrypted messages, signatures, and interoperability.

  • OpenPGP in Thunderbird: HOW-TO
    • 04

    Gpg4win

    Gpg4win Documentation

    Documentation for GnuPG on Windows, including Kleopatra and Outlook integration through GpgOL.

  • GPG4Win Info
    • 05

    OpenPGP.js

    OpenPGP.js Documentation

    Documentation for implementing OpenPGP in JavaScript applications, including supported browser and server environments.

  • OpenPGP.js Documentation