GnuPG and OpenPGP guides: install, keys, encrypt and sign
These guides show you how to use OpenPGP today with GnuPG (the gpg command) and the programs built on it. The commands have been checked against the GnuPG manual and tested with GnuPG 2.4 or 2.5, and each guide says what output to expect.
Start here
If you are new to PGP, work through these four steps in order. At the end you can encrypt, sign and verify files, and other people can find your public key.
- Install GnuPG. Most Linux systems already have it. On Windows install Gpg4win, and on macOS use GPG Suite or Homebrew. Then run
gpg --versionto see which version you have. - Create your key pair. One command,
gpg --full-generate-key, makes a modern Curve 25519 key. Choose an expiry date and a good passphrase, and keep the revocation certificate that GnuPG saves for you. - Publish your public key. Upload it to keys.openpgp.org and confirm your email address, or publish it on your own domain with a Web Key Directory. Then people can find it by your email address.
- Encrypt and sign. Encrypt files for a person or with a passphrase. Sign files and check signatures so people can tell a file came from you and was not changed.
After that, two guides cover everyday tasks: checking that downloaded software is genuine, using the Debian installer and GnuPG itself as real examples, and encrypted email in Thunderbird, Outlook, Apple Mail, Android and Proton Mail.
Which GnuPG version? As of November 2026 the stable GnuPG branch is 2.5 (latest release 2.5.24). The 2.4 branch reached end of life on June 30, 2026, but many Linux distributions still ship 2.4 with their own security fixes. The commands in these guides work the same on 2.4 and 2.5 unless a guide says otherwise.
How the guides work
- Commands are shown in boxes. Type them in a terminal (on Windows, in PowerShell or Command Prompt after installing Gpg4win). Lines that start with
gpg:in the example output are what GnuPG prints back. - Examples use the made-up name Alice Example and the address
alice@example.org. Put in your own details. - Wherever a guide says to check a fingerprint, take the time to do it. Comparing the 40-character fingerprint with one from a source you trust is the step that actually protects you.
- The guides explain what each command does and why, plus the mistakes people often make.
All guides
The full list, including keys on smartcards, backups, APT repository keys, Git signing, the OpenPGP standards and the history of PGP:
- Install GnuPGHow to install GnuPG on Debian, Ubuntu, Fedora, Arch, macOS (GPG Suite or Homebrew) and Windows (Gpg4win), check the version, and which branch is current.
- Create a keyMake a GnuPG key with --full-generate-key or --quick-generate-key, pick algorithm and expiry, keep the revocation certificate, then export and publish it.
- Encrypt filesEncrypt files with gpg --encrypt --recipient or a passphrase with --symmetric, encrypt whole folders with tar, decrypt them again, and avoid the usual mistakes.
- Sign and verifyMake detached .asc/.sig signatures with gpg --detach-sign, clearsign text, verify with gpg --verify, read Good/BAD signature output and check the signer's fingerprint.
- Verify downloadsWorked examples: check a Debian ISO with SHA512SUMS and SHA512SUMS.sign, verify a GnuPG tarball's .sig, compare release-key fingerprints, and what to do when it fails.
- Email encryptionOpenPGP email in 2026: Thunderbird's built-in OpenPGP, Gpg4win GpgOL for Outlook, Apple Mail, Android, Autocrypt, Proton Mail, and what stays visible.
- Backup and revokeHow to back up a GnuPG key (export-secret-keys, paperkey), restore it on a new computer, extend an expiry date, and revoke a key with its revocation certificate.
- Smartcards and YubiKeyPut your GnuPG subkeys on an OpenPGP card such as a YubiKey or Nitrokey: change the PINs, move keys with keytocard, keep a backup, and use the card for SSH.
- APT repository keysapt-key is gone in Debian 13 and Ubuntu 26.04. Add a third-party repository key with /etc/apt/keyrings, Signed-By and deb822 .sources files, and convert old commands.
- Git commit signingSet up signed Git commits and tags with an OpenPGP key or an SSH key, verify them locally, and get the Verified badge on GitHub and GitLab.
- OpenPGP standardsWhat each OpenPGP standard changed, from PGP 2 (RFC 1991) to RFC 9580 and post-quantum RFC 9980, the LibrePGP split, and what v4, v5 and v6 keys mean for you.
- PGP historyHow PGP began in 1991, the US export investigation dropped in January 1996, PGP Inc., NAI, PGP Corporation, Symantec and Broadcom, and how GnuPG and OpenPGP grew from it.
More help
If a command fails, look in common problems. It covers errors such as “No public key”, “Unusable public key” and passphrase prompts that never appear. To understand how keys, fingerprints and signatures fit together, read how PGP works. To find someone’s public key, try the key lookup.