PGP Basics: Encrypt Messages Without a Central Server
At a glance
PGP protects content, not the envelope. OpenPGP protects content and signatures, while normal email routing metadata remains exposed. A full fingerprint check over a second channel establishes key trust.
Sources
Data behind this diagram
| Surface | State | Reason |
|---|---|---|
| Message content | Protected | Encrypted to the recipient key |
| File content | Protected | Encrypted before transport or storage |
| Signature integrity | Protected | Detects alteration and control of the signing key |
| Email headers | Exposed | Normal routing metadata is outside OpenPGP content encryption |
| Recipient data | Exposed | Mail servers process addressing |
| Timing | Exposed | Transport timing remains observable |
| Server logs | Exposed | Transport systems can retain routing records |
Key points
- PGP lets you protect message content without trusting one company.
- Fingerprint checks matter more than keyserver convenience.
- PGP hides content, not the metadata around it.
Snapshot
- Standard
- OpenPGP
- Confirmed
- RFC
- Main risk
- Key trust
- Caution
- GnuPG
- Best for
- Confirmed
- Practice
- No
- Metadata
- Caution
- Model
Practical steps
1
Start with the threat model. OpenPGP encrypts content and creates digital signatures. It does not make email anonymous. Mail servers still process addressing and routing data, and OpenPGP does not hide traffic timing. If you need content protection, software signing, or encrypted files, OpenPGP can help. If you need an encrypted chat protocol with automatic key updates, compare it with Signal's protocol before choosing a tool.
2
Use a maintained implementation. GnuPG handles encryption, decryption, key management, and signatures. Linux distributions package it, while the project links to installers for other operating systems. Kleopatra provides a graphical key manager. Thunderbird has built-in OpenPGP support for email. Do not put a private key into an unreviewed browser tool.
3
Generate a key pair and guard the secret key. Create the key on a device you control and protect it with a strong passphrase. GnuPG creates a revocation certificate during standard key generation. Back it up somewhere separate from the private key. RFC 9580 specifies the current OpenPGP message format. Advanced users can keep a certification key offline and use separate signing and encryption subkeys.
4
Verify fingerprints, not names. Keyservers and pasted public keys only distribute keys. They do not prove identity. Before you encrypt anything sensitive, compare the full fingerprint over a second channel such as a voice call or in-person scan. The keys.openpgp.org service helps people find keys, but it does not replace verification. Trusting a key because the email address looks right is how you lose.
5
Encrypt and sign for different reasons. Encryption protects content from readers who lack the decryption key. A valid signature shows that the signer controlled the corresponding private key and that the signed data was not altered. Neither result proves a person's identity until you verify the key. The FSF Email Self-Defense guide covers a basic GnuPG workflow.
- Entry 1
- Encrypting files before cloud backup.
- Entry 2
- Signing software releases or public statements.
- Entry 3
- Exchanging sensitive email when both parties can verify fingerprints.
- Entry 4
- Creating durable identity keys not tied to one platform.
6
Know the usual failure points. Weak passphrases, lost revocation certificates, unverified keys, and exposed private keys defeat the protection you expected. OpenPGP does not encrypt normal email routing headers. Malware running as you can also capture plaintext before encryption or after decryption. For stronger key isolation, an OpenPGP smartcard can keep private-key operations on hardware, but it cannot secure a compromised screen or keyboard.
Sources
Frequently Asked Questions
Is PGP still useful in 2026?
Yes. PGP still works for email, file encryption, software signing, and identity checks when both sides verify fingerprints and protect private keys. It does not hide metadata, and it is clumsier than Signal, but it remains one of the few decentralized options.
Does PGP hide who I talk to?
No. OpenPGP protects message content and signatures. Email headers, timing, recipient data, and server logs still expose metadata unless you add separate transport protection and keep identities compartmentalized.
What is the most important safety check?
Verify the full key fingerprint through a second channel before trusting a public key. Skip that step and you can encrypt to an attacker key without realizing it.