Encrypted email with OpenPGP today: Thunderbird, Outlook, mobile

Updated November 2026

The easiest way to send OpenPGP email on a computer is Thunderbird, which has had OpenPGP built in since version 78. On Windows with Outlook, Gpg4win’s GpgOL add-in does the job. In every case, both people need a key pair, need each other’s public key, and should check each other’s fingerprint once.

Looking for the old pgp.net secure-email pages? They described tools from the 1990s and early 2000s. This page replaces them with what works as of November 2026.

What gets encrypted

Modern mail programs use PGP/MIME. The whole message body and all attachments are encrypted together into one part, so even the names of attachments are hidden. The older inline PGP encrypts the text and each attachment separately and leaks attachment names. Avoid it unless the other person’s software can do nothing else.

Some things cannot be encrypted, because mail servers need them to deliver the message:

the sender and recipient addresses, the date, and the servers the message passed through;
the size of the message and when it was sent;
the subject line, unless your program hides it. Thunderbird encrypts the subject by default. Proton Mail states that its subject lines are not end-to-end encrypted.

Anyone who can see your mail traffic, including your provider, can still tell who writes to whom and when. OpenPGP protects the content, not the fact that you are talking.

Thunderbird (Windows, macOS, Linux)

Thunderbird 78, released in 2020, added built-in OpenPGP, switched on by default from 78.2.1. It replaced the old Enigmail add-on, which no longer works with Thunderbird. Thunderbird does not use GnuPG by default. It uses its own OpenPGP library (RNP) and keeps keys inside your Thunderbird profile, separate from your ~/.gnupg keyring.

Open Account Settings, choose your account, and open the End-To-End Encryption section.
Click Add Key. Create a new key in Thunderbird, or import a key you already have in GnuPG. To import, first export it with gpg --armor --export-secret-keys alice@example.org > alice-secret.asc, import that file, then delete it.
Publish your public key so others can find it. Thunderbird looks up keys on keys.openpgp.org and through Web Key Directory (WKD), and since version 115 it can also upload your key to a keyserver (Web Key Directory, keys.openpgp.org).
To get a correspondent’s key, use Thunderbird’s key search (it checks WKD and keys.openpgp.org), or import a key they attached to a message. Thunderbird uses a key only after you accept it. Compare the fingerprint before you mark it as verified.
When you write a message, switch on encryption in the compose window. When encryption is on, signing and attaching your public key are switched on too.

Smartcards and existing GnuPG setups: if your secret key lives on a YubiKey or another OpenPGP card (Smartcards and YubiKey), set mail.openpgp.allow_external_gnupg to true in the Config Editor. Then choose “Use your external key through GnuPG” under Add Key and enter your key ID. GnuPG then handles decryption and signing. Thunderbird still uses its own library for encrypting to other people and for checking signatures.

Outlook on Windows: Gpg4win and GpgOL

Gpg4win (5.1.1 as of November 2026) includes GpgOL, an add-in for classic Outlook 2021, 2024 and Microsoft 365. It works with Exchange and with IMAP/SMTP accounts. You manage keys in Kleopatra, which is installed with it, and GpgOL adds encrypt and sign buttons to Outlook. For the new, web-based Outlook there is GpgOL/Web, which Gpg4win still described as experimental in March 2026. It runs a local service so that decrypted content stays on your computer. Gpg4win 5 needs 64-bit Windows 10 (1809 or later) or Windows 11. Installation is covered in the install guide.

Apple Mail on macOS

GPG Suite from gpgtools.org includes GPG Mail, which adds lock and sign buttons to Apple Mail. GPG Mail needs a paid support plan, which becomes a yearly subscription from version 8. As of November 2026, GPG Mail 8 for the newest macOS release is in beta and the vendor lists known issues. If you only need occasional encryption, Thunderbird on the Mac is a free alternative that works the same as on Windows and Linux.

Android and phones

On Android, OpenPGP email has long meant K-9 Mail together with OpenKeychain. K-9 hands all OpenPGP work to OpenKeychain, which holds your keys. K-9 Mail joined the Thunderbird project in 2022 and became the basis of Thunderbird for Android. Be aware of OpenKeychain’s status: its project page says the software is no longer actively developed. Security fixes and basic maintenance continue, but no new features are planned. Its most recent release tag is v6.0.4. If you start fresh, check the current status of OpenPGP support in Thunderbird for Android before you rely on it. On any phone, think about whether you want your secret key on the device at all.

Autocrypt: encryption without key servers

Autocrypt is an open specification that lets mail programs swap keys automatically. Each message carries the sender’s public key in an Autocrypt: header, so after one exchange of ordinary emails, both sides can encrypt. Delta Chat implements all of it. Thunderbird, K-9 Mail and Evolution implement parts of it. Thunderbird can always include your key in the Autocrypt header (since version 115). It works in a strict mode, though: you accept each correspondent’s key once before it is used.

Know the limit: by its own description, Autocrypt Level 1 defends only against passive data collection. Someone who can change messages in transit could swap in their own key. Comparing fingerprints once closes that gap.

Proton Mail and similar services

Proton Mail uses OpenPGP internally. Messages between Proton users are end-to-end encrypted without any setup. To exchange encrypted mail with someone who uses GnuPG or Thunderbird:

Turn on Attach public key (Settings → All settings → Proton Mail → Encryption and keys, or per message), so the other person gets your key.
When their signed message arrives with their key attached, choose Trust key. Or upload their key in Contacts under the contact’s email settings (“Show advanced PGP settings”).
Proton recommends PGP/MIME over PGP/Inline.

Remember that with a hosted service, the provider’s apps do the encryption and key handling for you. That is a different trust model from keeping the key on your own computer with GnuPG.

Without a mail plug-in

Any mail program can carry an encrypted attachment. Encrypt the file with gpg --encrypt --recipient (Encrypt files), attach the .gpg file, and write nothing confidential in the body or subject. This is clumsy for conversation, but it works everywhere.

Checklist

Keep a backup of your secret key (Backup and revoke). If you lose it, you can no longer read old encrypted mail.
Publish your public key (keys.openpgp.org with email verification, or WKD), so people can find it by address.
Check each correspondent’s fingerprint once, by phone or in person, before you mark the key as verified.
Use PGP/MIME, keep subject encryption switched on, and use neutral subjects with services that cannot encrypt them.
When you reply to an encrypted message, make sure encryption is still on before you click Send.