What Is PGP Encryption and How Does It Actually Work

PGP (Pretty Good Privacy) encryption is a method for scrambling messages and files so only the intended recipient can read them, using a clever pairing of two keys: a public key that anyone can use to encrypt data for you, and a private key that only you hold to decrypt it. Created by Phil Zimmermann in 1991, pretty good privacy encryption became the backbone of secure email and file sharing precisely because it lets strangers exchange encrypted messages without ever sharing a secret password first.

The magic sits in that two-key system, called asymmetric encryption or public key cryptography. Below we break down exactly what each key does, how a message travels from sender to recipient, and why PGP is still trusted more than 30 years after it appeared.

What PGP Encryption Actually Is

PGP is a program (and now an open standard called OpenPGP, defined in RFC 4880) that combines several types of encryption into one tool. It handles three jobs at once:

• Confidentiality - scrambles content so only the recipient can read it.
• Authentication - proves a message really came from who it claims.
• Integrity - shows whether the message was altered in transit.

Phil Zimmermann released it as free software during a period when strong encryption was tightly controlled in the United States. His publication triggered a three-year criminal investigation into whether he had violated arms-export laws, since encryption above a certain strength was classified as a munition. The case was dropped in 1996, and PGP went on to shape how private communication works today.

Public Keys vs Private Keys

Traditional (symmetric) encryption uses one shared password to both lock and unlock a message. That works fine until you need to send the password to someone, because now you have to protect the password too. PGP solves this with two mathematically linked keys.

Here is the key insight: anything encrypted with your public key can only be decrypted with your private key. So you can post your public key on your website, hand it out at a conference, or email it to strangers. They use it to encrypt a message to you, and only your private key can open it. Even the sender cannot decrypt their own message afterward. If you want a deeper dive into how RSA and ECC power this math, our advanced encryption guide walks through the algorithms behind it.

How PGP Encrypts a Message Step by Step

Public key cryptography is slow for large amounts of data, so PGP does something smart. It uses fast symmetric encryption for the actual message and uses the slow asymmetric keys only to protect the symmetric key. This is called a hybrid system.

1. Generate a session key. PGP creates a random, one-time symmetric key just for this message.
2. Encrypt the message. The full message is encrypted quickly using that session key.
3. Encrypt the session key. The session key itself is encrypted using the recipient's public key.
4. Send both together. The encrypted message and the encrypted session key travel as one package.
5. Recipient decrypts the session key. Their private key unlocks the session key.
6. Recipient reads the message. The session key decrypts the actual content.

This hybrid approach gives you the security of public key cryptography with the speed of symmetric encryption. It is the same reasoning behind modern secure messaging, which we cover in our piece on how safe end-to-end encryption really is.

Digital Signatures and Trust

PGP does more than hide content. It can also prove who sent a message using digital signatures, which work in reverse of encryption:

• The sender creates a hash (a short fingerprint) of the message.
• They encrypt that hash with their private key. This is the signature.
• The recipient decrypts the signature with the sender's public key.
• If the decrypted hash matches the message, it proves two things: the sender really wrote it, and nobody changed it in transit.

Because public keys are shared openly, PGP faces one big challenge: how do you know a public key really belongs to the person you think? PGP answers this with a "web of trust," where users sign each other's keys to vouch for them. The more trusted people who sign a key, the more confident you can be it is genuine. This is a decentralized alternative to the certificate-authority model used on the web, a topic we explore in how apps verify they are really secure.

How to Use PGP Encryption

You do not need to understand the math to use PGP. Most people use a tool that handles it for them. A typical workflow looks like this:

1. Install PGP software. Popular free options include GnuPG (GPG) for the command line, or apps like Kleopatra and Mailvelope for a graphical interface.
2. Generate your key pair. The software creates your public and private keys and asks for a strong passphrase to protect the private key.
3. Share your public key. Upload it to a keyserver or send it directly to contacts.
4. Encrypt. To message someone, import their public key and encrypt your text or file to it.
5. Decrypt. When you receive an encrypted message, your software uses your private key and passphrase to unlock it.

Where PGP Falls Short

PGP is powerful but famously awkward. Its weaknesses are why many people now use simpler tools for everyday privacy:

• Steep learning curve. Managing keys, passphrases, and keyservers trips up newcomers constantly.
• No forward secrecy. If your private key is ever compromised, every past message encrypted to it can be decrypted. Modern messengers rotate keys to avoid this.
• Metadata is exposed. PGP hides the message body but not who is talking to whom, or the subject line in email.
• Key verification is manual. Confirming a public key really belongs to someone takes effort most people skip.

For quick, one-off secure sharing, many people prefer a zero-knowledge approach where content is encrypted in the browser and never stored in plaintext. You can read how that differs from key-based systems in our explainer on zero-knowledge encryption. It also helps to understand encryption at rest versus in transit, since PGP mainly protects data as it travels and while it sits in your inbox.

Send an encrypted note without the PGP key hassle

Skip the public key exchange and web of trust. Our zero-knowledge tool encrypts your message in your browser, so sharing a secret is as simple as sending one self-destructing link.

Create a secure note →