PGP, standardised as OpenPGP, encrypts and digitally signs messages and files using key pairs. You encrypt to someone's public key, and only their private key can decrypt. You sign with your private key, and anyone with your public key can verify it. It suits files and signatures more than chat.
What is the standard?
RFC 9580, published in July 2024, specifies the OpenPGP message formats. Its abstract says OpenPGP provides encryption with public key or symmetric cryptographic algorithms, digital signatures, compression and key management. It obsoletes RFC 4880, the earlier OpenPGP message format, along with RFCs 5581 and 6637. It is an Internet Standard from the IETF.
"PGP" is the original program's name, and many tools use "PGP" and "OpenPGP" interchangeably. GnuPG is a widely used implementation. The format is what lets different tools exchange messages.
How does it work?
Each person has two linked keys. The public key is shared. The private key is secret.
Encrypting a message. The sender picks a random one-time symmetric key, encrypts the message with it, then encrypts that small key to the recipient's public key. Both go in one package. Symmetric encryption is fast for large data, and public key encryption handles the key delivery. Only the recipient's private key unlocks the one-time key.
Signing a message. The sender computes a digest of the message and signs it with their private key. The recipient checks the signature with the sender's public key. A valid signature shows the content has not changed and that it was made by the holder of that private key.
Trust. You also need to know the public key really belongs to the person. Classic PGP uses a web of trust, where people sign each other's keys. In practice many teams verify a key fingerprint over a second channel, such as a phone call or a published page.
What is it good for?
- Signing software releases and commits, so users can verify who published them.
- Encrypting a file or an email for a specific recipient, such as sending sensitive documents to an auditor.
- Encrypting backups to a key kept offline.
Where is it a poor fit?
Chat and everyday messaging, where modern protocols offer forward secrecy and easier key handling. PGP email also leaves subject lines and metadata visible, and mistakes like replying with the quoted plaintext are common. For transport security between servers, TLS is the standard tool.
What does a constructed example look like?
A small company must send payroll files to an external accountant. The accountant publishes a public key and its fingerprint on their website. The company's finance lead fetches the key, confirms the fingerprint by phone, and encrypts each file to that key before upload. Even if the file-sharing account is compromised, the files are unreadable without the accountant's private key.
How do you handle keys safely?
The private key is the whole security of the system.
- Protect it with a strong passphrase.
- Back it up in a place that survives a lost laptop, and keep that backup protected.
- Use a hardware token for high value keys where possible.
- Set an expiry date on keys and renew it. An unused key with no expiry is a liability.
- Create a revocation certificate when you make the key, and store it separately. It lets you tell others to stop using a lost key.
- Use a separate subkey for signing and for encryption if your tool supports it.
How to check or apply this
- Decide the job: signing releases, encrypting a file, or protecting backups.
- Choose a maintained tool that implements current OpenPGP, as specified in RFC 9580.
- Generate a key pair with an expiry and make a revocation certificate.
- Publish the public key and its fingerprint in two places.
- Verify recipients' fingerprints by a second channel before first use.
- Test the full cycle: encrypt, send, decrypt, and sign, verify.
Quick check
Is PGP the same as OpenPGP?
OpenPGP is the open standard, now RFC 9580. PGP is the original program, and the name is often used for the standard as well.
What happens if I lose my private key?
You cannot decrypt messages sent to it. Use a revocation certificate, created in advance, to tell others to stop using the key, then create a new one.
Sources
Last reviewed: 18 October 2026.
