How to Use GPG to Secure Your Email

Generate a GPG key pair, publish your public key, encrypt and sign email on the command line and in Thunderbird.

Why GPG Still Matters

Email is plaintext by default. TLS encrypts the transport between mail servers, but the message itself sits readable on every server it passes through, in every backup, and in every inbox. GPG (GNU Privacy Guard) gives you end-to-end encryption — only the intended recipient can read the message — and digital signatures that prove the message came from you and was not altered in transit.

GPG is the open-source implementation of the OpenPGP standard. It is free, auditable, and does not depend on any single provider.

Installing GPG

On Ubuntu / Debian

sudo apt update
sudo apt install gnupg2
gpg --version

You should see GnuPG 2.2 or later.

On Windows

Install Gpg4win, which bundles GnuPG, Kleopatra (a key manager GUI), and GpgOL (an Outlook plugin).

On macOS

brew install gnupg

Generating Your Key Pair

Generate a new key pair with strong defaults:

gpg --full-generate-key

When prompted:

Key type: select (1) RSA and RSA
Key size: 4096 bits
Expiration: 2y (two years — you can extend it later)
Real name: your full name as you want it to appear
Email address: the address you will use for encrypted mail
Passphrase: a strong passphrase you will remember — this protects the private key on disc

GPG generates your key pair and prints the key ID. Note it down.

Verifying Your Key

gpg --list-keys --keyid-format long

Output:

pub   rsa4096/0xABCDEF1234567890 2026-09-10 [SC] [expires: 2028-09-10]
      Key fingerprint = ABCD EF12 3456 7890 ABCD  EF12 3456 7890 ABCD EF12
uid                   [ultimate] Your Name <you@example.com>
sub   rsa4096/0x1234567890ABCDEF 2026-09-10 [E] [expires: 2028-09-10]

The pub line is your signing key. The sub line is your encryption subkey.

Exporting and Publishing Your Public Key

Your public key is what other people need to send you encrypted email and to verify your signatures.

Export to a File

gpg --armor --export you@example.com > publickey.asc

Publish to a Key Server

gpg --keyserver hkps://keys.openpgp.org --send-keys 0xABCDEF1234567890

You can also publish to keyserver.ubuntu.com or pgp.mit.edu. Key servers synchronise with each other, but keys.openpgp.org requires email verification, which reduces spam keys.

Publish Your Fingerprint

Put your full fingerprint on your website, your email signature, or your business card:

gpg --fingerprint you@example.com

The fingerprint is the authoritative identifier. When someone imports your key, they should verify the fingerprint through an out-of-band channel — in person, over a phone call, or from your published website.

Importing Someone Else's Key

From a Key Server

gpg --keyserver hkps://keys.openpgp.org --search-keys colleague@example.com

Select the correct key from the results. Then verify the fingerprint:

gpg --fingerprint colleague@example.com

From a File

gpg --import colleague-publickey.asc

Setting Trust

After verifying the fingerprint through an out-of-band channel:

gpg --edit-key colleague@example.com
gpg> trust

Select 4 (I trust fully) or 5 (I trust ultimately, reserved for your own keys). Then quit.

Encrypting and Signing on the Command Line

Encrypt a Message

echo "This is a confidential message." | gpg --armor --encrypt --recipient colleague@example.com > message.asc

The --armor flag produces ASCII output suitable for pasting into an email body. Without it, GPG produces binary.

Encrypt and Sign

echo "Confidential and authenticated." | gpg --armor --encrypt --sign --recipient colleague@example.com > message.asc

Signing proves the message came from you. Always sign when you encrypt.

Decrypt a Message

gpg --decrypt message.asc

GPG prompts for your passphrase, decrypts the message, and prints it to stdout. If the message was signed, it also verifies the signature.

Sign Without Encrypting

For messages that do not need confidentiality but need authentication:

echo "I approve this change." | gpg --armor --clearsign > signed-message.asc

The recipient verifies with:

gpg --verify signed-message.asc

Encrypt a File

gpg --encrypt --recipient colleague@example.com document.pdf

Produces document.pdf.gpg. Decrypt with:

gpg --decrypt document.pdf.gpg > document-decrypted.pdf

Using GPG with Thunderbird

Mozilla Thunderbird has built-in OpenPGP support since version 78. No plugin is required.

Import Your Key into Thunderbird

Thunderbird uses its own key store, separate from GnuPG's. Export your secret key:

gpg --armor --export-secret-keys you@example.com > secret-key.asc

In Thunderbird:

Go to Account Settings > End-to-End Encryption
Click Add Key > Import an existing OpenPGP key
Select secret-key.asc
Confirm and set as the default key for the account

Delete secret-key.asc from disc after importing. It contains your private key.

shred -u secret-key.asc

Import a Recipient's Public Key

In Thunderbird:

Go to Tools > OpenPGP Key Manager
Click File > Import Public Key(s) From File
Select the .asc file

Or right-click a received signed email and select Import OpenPGP Key.

Sending Encrypted Mail

Compose a new message. In the compose window, click the Security dropdown (or the lock icon) and select:

Require Encryption — the message will be encrypted
Digitally Sign This Message — the message will be signed

If Thunderbird has the recipient's public key, it encrypts automatically. If not, it warns you.

Setting Defaults

In Account Settings > End-to-End Encryption, you can set:

Enable encryption for new messages by default — recommended if most of your correspondents use GPG
Digitally sign all messages by default — recommended in all cases

Key Management Best Practices

Back Up Your Private Key

gpg --armor --export-secret-keys you@example.com > private-backup.asc

Store this on an encrypted USB drive in a physically secure location. If you lose your private key, you lose access to all encrypted messages sent to you.

Generate a Revocation Certificate

gpg --gen-revoke you@example.com > revocation.asc

Store this alongside your private key backup. If your key is compromised, publish the revocation certificate to key servers:

gpg --import revocation.asc
gpg --keyserver hkps://keys.openpgp.org --send-keys 0xABCDEF1234567890

Extend Expiry Before It Lapses

gpg --edit-key you@example.com
gpg> expire

Set a new expiry date, then republish:

gpg --keyserver hkps://keys.openpgp.org --send-keys 0xABCDEF1234567890

Use Subkeys for Daily Operations

Your master key (the one with the [SC] capability) should ideally be kept offline. Generate subkeys for encryption and signing:

gpg --edit-key you@example.com
gpg> addkey

Select RSA (sign only) with 4096 bits and an expiry. Repeat for an encryption subkey. Then export your subkeys for daily use and store the master key offline.

The GPG Agent

The GPG agent caches your passphrase so you do not need to type it for every operation. Configure it in ~/.gnupg/gpg-agent.conf:

default-cache-ttl 3600
max-cache-ttl 7200

This caches the passphrase for one hour, with a maximum of two hours. Restart the agent:

gpgconf --kill gpg-agent
gpgconf --launch gpg-agent

Hardening Your GPG Configuration

Edit ~/.gnupg/gpg.conf:

personal-cipher-preferences AES256 AES192 AES
personal-digest-preferences SHA512 SHA384 SHA256
personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed
default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed
cert-digest-algo SHA512
s2k-digest-algo SHA512
s2k-cipher-algo AES256
charset utf-8
keyid-format 0xlong
with-fingerprint
no-comments
no-emit-version

This prioritises strong algorithms and removes metadata that leaks version information.

Summary

Generate a 4096-bit RSA key pair, publish the public key to a key server, verify fingerprints out-of-band, and use Thunderbird's built-in OpenPGP support for everyday email. Keep your master key backed up offline, maintain a revocation certificate, and extend expiry before it lapses. GPG is only as strong as your key management — the cryptography is sound; the discipline around it is what makes or breaks the system.