How to Use GPG to Encrypt and Decrypt Files

GPG gives you two main ways to encrypt a file: protect it with a password, or encrypt it with someone’s public key. A password is handy when the file is for you, or when you can send the password through a separate secure channel. If the recipient has already given you a verified GPG public key, public-key encryption is usually the better fit.

The Short Version

Encrypt a file with a password:

gpg --symmetric document.pdf

GPG will ask for a passphrase, then create document.pdf.gpg. To decrypt it:

gpg --output document.pdf --decrypt document.pdf.gpg

Encrypt a file for someone who has a public key:

gpg --encrypt --recipient user@example.com document.pdf

The recipient uses their private key to decrypt the resulting file:

gpg --output document.pdf --decrypt document.pdf.gpg

One warning: Make sure you can decrypt the encrypted copy before you delete the original. If you lose the password or the required private key, you’ll usually lose access to the data for good.

What You’ll Need

• GPG installed on your computer
• The file you want to protect
• A strong passphrase for symmetric encryption, or the recipient’s verified public key
• A secure backup of your private key if you’re using public-key encryption

Installing GPG

Windows

Install Gpg4win from its official website. The default installation includes both the GPG command-line tools and Kleopatra, its graphical key manager. Once installation is finished, open PowerShell or Command Prompt and check the version:

gpg --version

macOS

With Homebrew installed, run:

brew install gnupg

Ubuntu and Debian

sudo apt update
sudo apt install gnupg

Fedora

sudo dnf install gnupg2

Encrypting a File with a Password

Symmetric encryption uses one passphrase for both encryption and decryption. There’s no GPG key pair to create, and no public key to exchange.

1. Open a terminal in the folder where the file is stored.
2. Run the symmetric encryption command.
3. When prompted, enter a long passphrase that you don’t use anywhere else.
4. Check that the new .gpg file exists.

gpg --symmetric financial-records.xlsx

If you want to set the encrypted file’s name yourself, use --output:

gpg --output protected-records.gpg --symmetric financial-records.xlsx

Need an ASCII-armored file for a text-oriented system? Add --armor:

gpg --armor --symmetric financial-records.xlsx

This will normally produce a file ending in .asc. ASCII armor makes the file larger, though, so ordinary binary .gpg output is generally a better choice for regular file storage.

Decrypting a Password-Protected File

Give GPG an output filename so it doesn’t write the decrypted data to the terminal:

gpg --output financial-records.xlsx --decrypt protected-records.gpg

Enter the passphrase when GPG, or its pinentry window, asks for it. If something already exists at that output path, GPG may ask whether you want to overwrite it.

Encrypting a File with a Public Key

Public-key encryption works with two related keys. Anyone who has the public key can encrypt data for the owner. Decryption, however, requires the matching private key.

1. Create a Key Pair

If you don’t already have a key pair, start here:

gpg --full-generate-key

Work through the prompts to choose a supported algorithm, key size and expiration period, then provide an identity and passphrase. Setting an expiration date limits how long a forgotten or abandoned key remains useful. You can extend that date later.

2. Check the Available Keys

gpg --list-keys

To display a key fingerprint, which you’ll use to verify the owner’s identity, run:

gpg --fingerprint user@example.com

3. Import the Recipient’s Public Key

gpg --import recipient-public-key.asc

After importing it, compare the key’s complete fingerprint with the owner through a separate, trusted channel. Don’t treat the email address printed on the key as proof of ownership. It isn’t.

4. Encrypt the File

gpg --output confidential.zip.gpg --encrypt --recipient user@example.com confidential.zip

If more than one key matches that identity, use the complete fingerprint rather than the email address. You may also want the file to remain readable by you. In that case, add your own identity as a second recipient:

gpg --encrypt --recipient user@example.com --recipient me@example.com confidential.zip

Exporting Your Public Key

Other people need your public key if they’re going to encrypt files for you. Exporting it won’t expose your private key.

gpg --armor --export me@example.com > my-public-key.asc

Send the resulting .asc file to the person encrypting the data. Then confirm your complete fingerprint through another trusted method, separately from the key file itself.

Handy GPG File Commands

Mistakes That Cause Trouble

• Deleting the original too soon: Decrypt a test copy and inspect the restored file before removing anything.
• Sending the password with the attachment: Pass it along through a separate secure channel instead.
• Using a public key you haven’t verified: Compare the complete fingerprint directly with the key owner.
• Leaving yourself off the recipient list: With public-key encryption, the sender may be unable to read the encrypted file unless their own key is included.
• Putting passphrases in commands: Use GPG’s secure prompt. A passphrase typed into the command itself can end up in shell history or scripts.
• Expecting encryption to erase the source file: GPG makes an encrypted copy. It doesn’t securely delete the original.

Checking the Encrypted Copy

1. Hold on to the original file for now.
2. Decrypt the encrypted copy under a different output name.
3. Open that restored file and make sure the contents are intact.
4. For data that matters, compare cryptographic checksums for the original and decrypted files.
5. Back up any private key you’ll need for future decryption.

Encryption keeps the contents confidential, but it’s no substitute for backups. Store encrypted backups somewhere separate, and record which key will be needed to recover them.