GnuPG is a complete, free implementation of the OpenPGP standard (RFC 4880).
Basics
Exporting Keys
gpg -o key.gpg --export <KEY ID>
Export ASCII-armored key:
gpg -o key.asc --armor --export <KEY ID>
Note: If -o | --output is omitted, the key will be printed directly to stdout.
Importing Keys
gpg --import key.gpg
gpg --import key.asc
Merge updates into existing keyring keys only:
gpg --import key.asc --import-options merge-only
Keyring Management
Generate a new keypair:
gpg --gen-key
# Or generate a new key with full dialog prompts for all options:
gpg --full-gen-key
List public keys:
gpg -k
gpg --list-keys
List secret / private keys:
gpg -K
gpg --list-secret-keys
Using Keyservers
Import keys from a public keyserver:
gpg --receive-keys <KEY IDS>
Upload public keys to a keyserver:
gpg --send-keys <KEY IDS>
Refresh all existing keys in your keyring against keyservers:
gpg --refresh-keys
Search keys on keyserver:
gpg --search-keys "<SEARCH STRING>"
Override default keyserver in ~/.gnupg/gpg.conf:
gpg --keyserver <URL> ...
Trusting & Signing Keys
gpg --edit-key <KEY ID>
# Inside the interactive prompt:
gpg> trust
gpg> save
Note: You can use the owner's email address or name substring in place of <KEY ID> when running --edit-key.
Encryption
Asymmetric Public-Key Encryption
Encrypts a file such that only the designated recipient possessing the private key can decrypt it:
gpg -e -o secret.txt.gpg -r <RECIPIENT> secret.txt
<RECIPIENT> can be a Key ID, email address, or name:
gpg -e -r <KEY ID> secret.txt
gpg -e -r "Alice Smith" secret.txt
gpg -e -r "[email protected]" secret.txt
Encrypt for multiple recipients simultaneously:
gpg -e -r <RECIPIENT_1> -r <RECIPIENT_2> secret.txt
Symmetric Passphrase Encryption
Encrypts a file with a shared passphrase prompt:
gpg --symmetric secret.txt
# or shorthand:
gpg -c secret.txt
Decryption
Decrypting Files
gpg -d -o secret.txt secret.txt.gpg
If symmetrically encrypted, GPG prompts for the passphrase; if asymmetrically encrypted, it prompts for the private key passphrase.
Note: Omitting -o | --output prints the decrypted payload directly to stdout.
Signatures & Verification
Digital Signing
Sign and compress file:
gpg -o signed-file.txt.gpg -s file.txt
Encrypt and sign simultaneously:
gpg -s -o secret.txt.gpg -r <RECIPIENT> secret.txt
Clear-signed text document (readable plain text with ASCII signature appended):
gpg --clearsign file.txt
Detached signature:
gpg -b file.txt
Verifying Signatures
gpg --verify file.txt.gpg
gpg --verify file.txt.sig file.txt
Viewing Content of Signed Files
gpg -d signed-file.txt.gpg
Components & Daemons
List running GPG components:
gpgconf --list-components
Kill a specific daemon:
gpgconf --kill dirmngr
gpgconf --kill gpg-agent
Kill all running GPG daemons:
gpgconf --kill all
Machine-Readable Colon Listing
Use --with-colons to generate machine-parsable colon-delimited records for scripting with awk or grep:
gpg -k --with-colons
| Field Index | Description |
|---|---|
| 1 | Record type (pub, sec, uid, sub) |
| 2 | Validity flag |
| 3 | Key length (bits) |
| 4 | Public key algorithm ID |
| 5 | Key ID |
| 6 | Creation date |
| 7 | Expiration date |
| 8 | Certificate S/N, UID hash, or trust signature |
| 9 | Owner trust level |
| 10 | User ID string |
| 11 | Signature class |
| 12 | Key capabilities (e = encrypt, s = sign, c = certify, a = authenticate) |