PGP :: WINDOWS / LINUX / macOS

WHAT IS PGP?

PGP/OpenPGP uses a key pair: a public key and a private key. The public key can be shared so other people can encrypt messages for you. The private key stays on your device and is used to decrypt messages or create signatures.

The fingerprint is the human-checkable identity of a key. Before trusting a key, compare its fingerprint through a trusted channel.

WINDOWS

Recommended tool: Gpg4win + Kleopatra

Gpg4win is the standard Windows package for GnuPG. It includes Kleopatra, a graphical certificate and key manager.

1. Download Gpg4win from the official website:
   https://www.gpg4win.org/download.html

2. Install it with the default components.

3. Open Kleopatra.

4. Create a new OpenPGP key pair:
   File > New OpenPGP Key Pair

5. Enter your name and email address.

6. Protect the private key with a strong passphrase.

7. Export your public key:
   Right-click your certificate > Export

8. Keep your private key backup offline and protected.

Windows command line

gpg --full-generate-key

gpg --list-secret-keys --keyid-format=long

gpg --armor --export your@email.tld > public_key.asc

gpg --armor --export-secret-keys your@email.tld > private_key_BACKUP.asc

LINUX

Install GnuPG

On many Linux distributions, GnuPG is already installed or available directly from the default repositories.

# Debian / Ubuntu
sudo apt update
sudo apt install gnupg -y

# Fedora
sudo dnf install gnupg2 -y

# Arch / CachyOS
sudo pacman -S gnupg

Create and manage keys

# Create a key pair
gpg --full-generate-key

# List public keys
gpg --list-keys

# List private keys
gpg --list-secret-keys --keyid-format=long

# Show a fingerprint
gpg --fingerprint your@email.tld

# Export public key
gpg --armor --export your@email.tld > public_key.asc

# Export private key backup
gpg --armor --export-secret-keys your@email.tld > private_key_BACKUP.asc

Encrypt and decrypt

# Import someone else's public key
gpg --import contact_public_key.asc

# Encrypt a file for a recipient
gpg --encrypt --armor --recipient contact@email.tld file.txt

# Decrypt a file
gpg --decrypt file.txt.asc > file.txt

Sign and verify

# Create a detached signature
gpg --armor --detach-sign file.txt

# Verify a signature
gpg --verify file.txt.asc file.txt

macOS

Recommended tool: GPG Suite

GPG Suite provides GPG Keychain for managing OpenPGP keys and can integrate with Apple Mail through GPG Mail.

1. Download GPG Suite from the official website:
   https://gpgtools.org/

2. Install the package.

3. Open GPG Keychain.

4. Create a new key pair.

5. Set a strong passphrase.

6. Export your public key as an .asc file.

7. Back up your private key securely.

Alternative: Homebrew

# Install GnuPG with Homebrew
brew install gnupg

# Generate a key pair
gpg --full-generate-key

# Export public key
gpg --armor --export your@email.tld > public_key.asc

COMMON GOOD PRACTICES

• Use a strong passphrase for your private key.
• Back up your private key offline.
• Publish only your public key.
• Verify fingerprints before encrypting sensitive content.
• Create a revocation certificate and store it safely.
• Use subkeys when possible for daily encryption/signing.

gpg --output revoke.asc --gen-revoke your@email.tld

PROTON MAIL NOTE

Proton Mail can attach your public key to messages and also lets you manage, download, export, or import PGP keys from its encryption and keys settings.

SOURCES

• Gpg4win official download
• GnuPG official download
• GPG Suite for macOS
• Proton Mail PGP guide