Encrypt and decrypt files and folders with GnuPG

Updated November 2026

To encrypt a file for someone, use gpg --encrypt --recipient their@address file. To protect it with a password instead, use gpg --symmetric file. GnuPG works on single files, so to encrypt a folder, pack it with tar first. Always add yourself as a recipient so you can open the file later.

Two ways to encrypt

To a public key (--encrypt): Only the people whose keys you list can decrypt the file. You never share a password. This is the normal choice for sending files to other people.
With a passphrase (--symmetric): Anyone who knows the passphrase can decrypt the file. No keys are needed. This suits your own backups, or a file you hand to someone in person and whose passphrase you tell them another way. By default GnuPG uses AES-256 for this.

Behind the scenes, both kinds use a random session key to encrypt the data. With --encrypt, that session key is then encrypted to each recipient’s public key. With --symmetric, it comes from your passphrase. See How PGP works.

Get the recipient’s key first

You need the recipient’s public key in your keyring. Import it from a file they sent, or look it up by email address:

gpg --import bob-public.asc
gpg --keyserver hkps://keys.openpgp.org --auto-key-locate wkd,keyserver --locate-external-keys bob@example.net

The second command first tries Bob’s own domain (Web Key Directory) and then keys.openpgp.org. Without --auto-key-locate, GnuPG only looks in your keyring and WKD, because the default is local,wkd.

Then check the fingerprint with Bob over the phone, in person, or from a source you trust:

gpg --fingerprint bob@example.net

If it matches, record that you checked it. This command makes a local (non-exportable) certification with your own key:

gpg --quick-lsign-key FINGERPRINT

Replace FINGERPRINT with Bob’s full 40-character fingerprint, written without spaces. You need your own key for this step (Create a key). Until you do this, GnuPG warns “There is no assurance this key belongs to the named user” and asks before it uses the key. In batch mode it simply refuses with “Unusable public key”.

Encrypt a file to a person

gpg --encrypt --recipient bob@example.net --recipient alice@example.org report.pdf

This creates report.pdf.gpg next to the original, which is left unchanged. The second --recipient is you: GnuPG does not add you automatically, so without it you could not open your own file later. Short forms: -e for --encrypt, -r for --recipient.

Useful extras:

--armor writes text instead of binary, so the result is report.pdf.asc and you can paste it into a message.
--output name picks the output file name.
--sign together with --encrypt signs the file as well, so Bob can check it came from you: gpg --sign --encrypt -r bob@example.net -r alice@example.org report.pdf.
--hidden-recipient (-R) leaves the recipient’s key ID out of the file. This is a limited protection against someone working out who the file is for.
To always add yourself, put encrypt-to followed by your fingerprint in ~/.gnupg/gpg.conf. It applies whenever there is at least one other recipient.

Encrypt with a passphrase

gpg --symmetric report.pdf

GnuPG asks for a passphrase twice and writes report.pdf.gpg. When you decrypt it, GnuPG reports:

gpg: AES256.CFB encrypted data
gpg: encrypted with 1 passphrase

GnuPG remembers the passphrase for a short time (it is cached in gpg-agent). If you test the file straight away, it may open without asking. To check that the passphrase really works, decrypt with --no-symkey-cache. Choose a long passphrase. Anyone who gets the file can try to guess it offline as often as they like.

Decrypt

gpg --output report.pdf --decrypt report.pdf.gpg

gpg: encrypted with cv25519 key, ID 18815D9DBD509471, created 2026-11-04
      "Alice Example <alice@example.org>"

GnuPG asks for your key’s passphrase and writes report.pdf. If you leave out --output, the decrypted data goes to the screen (standard output). If the file was also signed, GnuPG checks the signature and prints “Good signature from …” as well. If a file with the output name already exists, GnuPG asks before it overwrites it.

Encrypt a whole folder

GnuPG encrypts streams of bytes, not folders. Pack the folder with tar and send the stream straight into gpg, so that no unencrypted archive is written to disk:

tar -czf - taxes/ | gpg --encrypt -r alice@example.org --output taxes.tar.gz.gpg

To unpack it again:

gpg --decrypt taxes.tar.gz.gpg | tar -xzf -

To list the contents without unpacking, use gpg --decrypt taxes.tar.gz.gpg | tar -tzf -. The same pattern works with --symmetric instead of --encrypt -r …. On Windows, Gpg4win’s Kleopatra and Explorer right-click menu offer the same functions without the command line.

Several files at once

--encrypt-files (the same as --multifile --encrypt) encrypts each file named on the command line separately:

gpg --encrypt-files -r alice@example.org *.csv

For a file you have already encrypted, GnuPG 2.5 can add or replace recipients without decrypting all the data: gpg --add-recipients -r carol@example.com --output new.gpg report.pdf.gpg. --change-recipients removes the old recipients. Both are new in 2.5 and do not exist in 2.4.

Common mistakes

Forgetting yourself as a recipient. You cannot decrypt a file that was encrypted only to Bob. Add -r with your own address, or set encrypt-to.
Leaving the original behind. gpg never deletes the plain file. Delete it yourself once you have checked that the encrypted copy decrypts. On modern disks a deleted file may still be recoverable for a while, so the safest habit is to create sensitive files inside encrypted storage in the first place.
Trusting an unchecked key. If you encrypt to a key someone swapped in, that person can read the file. Compare fingerprints first.
Expecting the file name and size to be hidden. The encrypted file’s own name (for example taxes.tar.gz.gpg) and its rough size are still visible. Use a neutral file name if that matters.
Putting passphrases on the command line. The manual calls --passphrase “of very questionable security on a multi-user system”, and the passphrase also ends up in your shell history. For scripts, use --batch --pinentry-mode loopback --passphrase-file with a file only you can read.
Encrypting to an expired or revoked key. GnuPG refuses. Refresh the key with gpg --refresh-keys, or ask the person for their current key.

Error messages such as “No public key”, “Unusable public key” or “decryption failed: No secret key” are explained in Common problems.