PGP and GPG Encryption for Email

Phil Zimmermann released Pretty Good Privacy in 1991, making strong encryption available to ordinary people for the first time. The US government initially investigated him for exporting munitions without a license because encryption was classified as a weapon. The case was dropped in 1996, and PGP became a landmark in personal privacy technology.

PGP uses asymmetric cryptography: you generate a mathematically linked key pair. The public key can be shared freely and is used by others to encrypt messages to you. The private key is kept secret and is used to decrypt those messages. Losing your private key means losing access to all encrypted data.

To send an encrypted email to someone, you obtain their public key and use it to encrypt the message. Only the holder of the matching private key can decrypt and read it. PGP actually uses hybrid encryption: a random session key encrypts the message with a symmetric cipher, and then the session key itself is encrypted with the recipient's public key.

You can also sign a message using your private key. The recipient verifies the signature with your public key, confirming both that you sent it and that the content has not been altered. Signing and encrypting are independent operations that can be combined: you typically sign then encrypt, or encrypt then sign depending on your threat model.

PGP does not rely on certificate authorities. Instead it uses a Web of Trust where individuals sign each other's public keys to vouch for their authenticity. If Alice trusts Bob and Bob has signed Carol's key, Alice can have indirect trust in Carol's key. The model works well in technical communities but is difficult to bootstrap for general users.

GNU Privacy Guard, commonly called GPG or GnuPG, is a free open-source implementation of the OpenPGP standard. It runs on Linux, macOS, and Windows and provides both a command-line interface and a library for integrating PGP functionality into applications. GPG is the de-facto standard tool for OpenPGP operations today.

Running gpg --full-generate-key walks you through selecting an algorithm, key size, and expiry date. Ed25519 is the modern choice for signing and Curve25519 for encryption. You must set a passphrase that protects your private key on disk. The generation process collects entropy from system activity to ensure randomness.

After generating a key pair you export your public key with gpg --armor --export your@email.com and share the resulting text block. Recipients import it with gpg --import. You can paste your public key on your website, in your email signature, or on a key server. Never share your private key file.

Key servers like keys.openpgp.org and keyserver.ubuntu.com let people publish and find public keys. You upload your key with gpg --keyserver keys.openpgp.org --send-keys YOURKEYID. The modern keys.openpgp.org requires email verification before publishing, reducing the problem of fake keys being uploaded for other people's addresses.

To encrypt a file: gpg --encrypt --recipient recipient@email.com --armor file.txt produces file.txt.asc. To decrypt: gpg --decrypt file.txt.asc. For email, tools like Thunderbird with the built-in OpenPGP support or the Enigmail add-on integrate GPG directly into the email composition window, handling key lookup and encryption transparently.

PGP encryption protects the message body but the To, From, Subject, and date fields remain in plaintext. Key management is complex: users must find, verify, and trust recipient keys. Encrypted email cannot be searched or indexed by mail servers. These usability barriers have limited PGP adoption outside technical communities despite its strong security properties.

When you want to send an encrypted email to a colleague using PGP, which key do you use to encrypt the message?

PGP provides end-to-end encryption and digital signatures for email using public-private key pairs. GPG is the free open-source implementation. The Web of Trust replaces centralised CAs. Public keys can be shared on key servers while private keys must be protected with a strong passphrase. Usability remains the main barrier to widespread adoption.