Install GnuPG on Linux, macOS and Windows (2.4 and 2.5)

Updated November 2026

On most Linux systems GnuPG is already installed, so you only need to check the version. On Windows install Gpg4win, and on macOS install GPG Suite or the Homebrew gnupg package. As of November 2026 the current stable branch is GnuPG 2.5.

Which version is current

GnuPG keeps two kinds of release branch, and the GnuPG download page lists an end-of-life date for each one. As of November 2026:

GnuPG branches as of November 2026 (source: gnupg.org)
BranchLatest releaseStatus
2.52.5.24 (September 23, 2026)Stable and long-term support; end of life not yet announced. A later split into 2.6 (stable) and 2.7 (development) is planned.
2.42.4.9 (December 30, 2025)End of life on June 30, 2026
2.22.2.45 (October 22, 2024; last release on gnupg.org)End of life on December 31, 2024 (paid extended support exists)
1.41.4.23 (2018)Legacy. Kept only for old PGP 2 keys; not for everyday use

GnuPG declared the 2.5 series stable with version 2.5.16 in December 2025. The main new feature of 2.5 is post-quantum encryption: it adds Kyber (ML-KEM) as an encryption algorithm. Distributions often ship an older branch and add security fixes themselves without changing the version number, so an older version number from your distribution is not automatically unsafe.

Debian and Ubuntu

GnuPG is part of the base system. Check that it is there, and install it if it is missing:

gpg --version
sudo apt update
sudo apt install gnupg

Versions in the distribution archives, as of November 2026:

ReleaseGnuPG package
Debian 12 “bookworm”2.2.40
Debian 13 “trixie”2.4.7
Ubuntu 22.04 LTS2.2.27
Ubuntu 24.04 LTS2.4.4
Ubuntu 26.04 LTS2.4.8

Optional: GnuPG 2.5 from the GnuPG repository

The GnuPG project runs its own APT repositories with unmodified upstream builds for Debian 12 and 13, Devuan, and Ubuntu 22.04, 24.04 and 26.04. Each release has a stable repository (for example trixie) and a -devel one. This example is for Debian 13. For another release, replace every trixie below with bookworm, jammy, noble or resolute:

curl -fsSL -o /tmp/gnupg-signing-key.gpg https://repos.gnupg.org/deb/gnupg/trixie/gnupg-signing-key.gpg
gpg --show-keys /tmp/gnupg-signing-key.gpg

Check the output before you go on. It should show one key, “GnuPG.org Package Signing Key <package-maintainers@gnupg.org>”, whose fingerprint ends in 85C45AE3E1A2B355, the key ID shown in the GnuPG project’s own instructions. In November 2026 the full fingerprint was 3209 7B71 9B37 45D6 E61D DA1B 85C4 5AE3 E1A2 B355. If it does not match, stop. Then install the key and the repository entry:

sudo install -d -m 0755 /etc/apt/keyrings
gpg --dearmor < /tmp/gnupg-signing-key.gpg | sudo tee /etc/apt/keyrings/gnupg-keyring.gpg >/dev/null
sudo chmod 0644 /etc/apt/keyrings/gnupg-keyring.gpg

sudo tee /etc/apt/sources.list.d/gnupg.sources >/dev/null <<'EOF'
Types: deb
URIs: https://repos.gnupg.org/deb/gnupg/trixie/
Suites: trixie
Components: main
Signed-By: /etc/apt/keyrings/gnupg-keyring.gpg
EOF

sudo apt update
sudo apt install -t trixie gnupg2
gpgconf --kill all

The GnuPG project’s own instructions put the key in /usr/share/keyrings/; this guide uses /etc/apt/keyrings/, the place sources.list(5) gives for keys you add yourself. Either works, as long as Signed-By names the file. The -t trixie option is what the GnuPG project recommends: it makes APT install gpg-agent, dirmngr, Libgcrypt and the other parts from the new repository too. Check the result with apt policy gnupg2. gpgconf --kill all stops any old gpg-agent or dirmngr that is still running. GnuPG starts the new ones when it needs them. If you use a smartcard, also install scdaemon, because it is not pulled in automatically. For the general rules on repository keys, see APT repository keys.

Fedora, RHEL and similar

The package is called gnupg2 and is normally already installed. As of November 2026, Fedora 43 and 44 ship 2.4.9 and CentOS Stream 10 ships 2.4.5.

sudo dnf install gnupg2

Arch Linux

The package is gnupg in the core repository (2.4.9 as of November 2026):

sudo pacman -S gnupg

If you want a graphical key manager on Linux, install Kleopatra from your distribution. It is the same program that Gpg4win uses on Windows.

macOS

You have two options.

GPG Suite (gpgtools.org)
A disk-image installer with GPG Keychain (a key manager), GPG Services (encrypt and sign from the right-click Services menu), MacGPG (the gpg command) and GPG Mail for Apple Mail. GPG Mail needs a paid support plan. As of November 2026 GPG Mail 8 for the newest macOS is still in beta. The download page also gives an OpenPGP signature and a SHA-256 checksum for the installer.
Homebrew
The gnupg formula follows upstream closely; it was at 2.5.24 in November 2026.
brew install gnupg pinentry-mac
mkdir -p -m 700 ~/.gnupg
echo "pinentry-program $(brew --prefix)/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

The pinentry-mac line gives you a normal macOS window for passphrases. Without it, GnuPG asks in the terminal, and that fails in programs that have no terminal (for example Git in an editor).

Windows: Gpg4win

Gpg4win bundles GnuPG with the Kleopatra key manager, a right-click menu in Explorer and the GpgOL add-in for Outlook. As of November 2026 the current version is Gpg4win 5.1.1 (released September 23, 2026, alongside GnuPG 2.5.24).

Check that it works

Open a new terminal and run:

gpg --version

With GnuPG 2.5.24 the output starts like this:

gpg (GnuPG) 2.5.24
libgcrypt 1.12.4
...
Home: /home/alice/.gnupg
Supported algorithms:
Pubkey: RSA, Kyber, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Kyber in the Pubkey line means you have a 2.5 build with post-quantum support. The Home line shows the folder where your keys and settings are kept.

Common problems

Next step: create your key pair.

Sources