What is PGP Encryption? The Complete Illustrated Guide
No jargon, no maths. We start with why an ordinary message is not private, build up to key pairs with pictures, and finish with the story of how PGP survived a criminal investigation to become the standard the whole internet still uses.
1. Why a normal message is not private
When you send a message without encryption, it does not travel in a sealed envelope. It travels like a postcard. Every machine that passes it along - the wi-fi in the cafe, your internet provider, the company running the app, whoever runs the servers in between - can read every word, and often keeps a copy.
Encryption fixes this by scrambling the message before it leaves your device, in a way that only the intended reader can undo. Everything below is about one question: how do the two of you agree on how to unscramble it, without a spy learning the same trick?
2. One secret key: symmetric encryption
The oldest idea is the simplest one. You and your friend agree on a secret - a password, a number, a codebook - and you use that same secret to scramble the message and to unscramble it. Lock and unlock with the same key. This is called symmetric encryption, and modern versions of it, like AES-256, are extremely fast and effectively unbreakable.
There is one enormous catch, and it kept cryptography a specialist tool for centuries: both people need the identical key before they can talk safely. If you email the key, the spy reading your email now has it too. You could meet in person and whisper it - but that does not scale to strangers on the internet, and it certainly does not work when you want to receive a message from someone you have never met.
3. Two keys instead of one: asymmetric encryption
In the 1970s came the idea that makes all of this work. Instead of one key that does both jobs, you get a pair of keys that are mathematically linked. One of them can only lock. The other can only unlock. You publish the locking one and keep the unlocking one.
That is why every PGP user needs a key pair of their own. Your public key is your address for private mail: anyone can use it to lock something for you. Your private key is the single object in the world that opens those messages - which is exactly why it never leaves your device, and why losing it means losing the messages.
Notice what never happened in that picture: you and Bob never had to share a secret in advance. He publishes a padlock, you use it, and the scrambled result is useless to everyone else - including you, the moment you have locked it.
4. Signatures: proving who really wrote it
The pair works in the other direction too, and that gives us something just as useful as secrecy: proof of authorship. If Bob scrambles something with his private key, then anybody can unscramble it with his public key - which is pointless for privacy, but perfect as a seal. Only Bob could have produced it.
A PGP signature tells you two things at once: the message really came from the holder of that key, and not a single character has been altered since. It is how Linux distributions prove a download is genuine, and how you can be sure an email is not an impersonation.
5. So what exactly is PGP?
PGP - Pretty Good Privacy - is the recipe that packages all of the above into something usable. Asymmetric encryption is powerful but slow, so PGP does something clever: it invents a brand-new one-time key for each message, locks the message with that fast symmetric key, and then locks the little key itself with the recipient's public key.
The result is a single block of text starting with -----BEGIN PGP MESSAGE----- that you can paste into any chat, email or forum. PGP also defines the format of keys themselves, of signatures, of expiry dates and fingerprints - which is why a key made in Kleopatra works in GnuPG, Thunderbird or Proton Mail without anyone agreeing on anything in advance.
The original 1991 program by Phil Zimmermann. Later a commercial product.
The public standard written from it, so anyone can build compatible tools. RFC 4880, modernised as RFC 9580.
The best known free implementation of that standard, and the engine inside many desktop tools.
They are compatible with each other. When someone says “send me your PGP key” today, any of these tools will do.
6. How to use PGP in 4 steps
Theory over. Here is the whole workflow - it takes about two minutes, and every step below opens the tool directly.
Step 1 - Create your key pair
One click. Kleopatra makes your private key and its matching public key right in your browser - nothing is sent anywhere. Protect it with a passphrase if this device is shared.
Create a key pairStep 2 - Share your public key
Export it and send it to whoever should be able to write to you: paste it in a chat, an email signature, a profile page. It cannot be used to read anything - only to lock messages addressed to you.
Open my keysStep 3 - Encrypt a message
Import the other person's public key, pick them as the recipient, write your text and encrypt. You get a PGP block you can paste into any app - the app itself never sees the plain text.
Encrypt a messageStep 4 - Decrypt what you receive
Paste the block someone sent you. Your private key unlocks it on your device, and any signature is checked automatically against the public keys you hold.
Decrypt a messageOne rule to remember
Give away your public key as freely as you like. Never send anyone your private key - not support, not a website, not a friend. No honest service will ever ask for it.
7. The story of PGP and OpenPGP
PGP is not just a piece of software: it is the reason ordinary people are allowed to use strong encryption at all. The fight that made it happen is worth knowing.
Phil Zimmermann releases PGP 1.0
An anti-encryption bill is moving through the US Senate. Zimmermann writes PGP and gives it away for free; it spreads worldwide through Usenet in days.
The US government opens a criminal investigation
Strong cryptography is legally classified as a munition. Zimmermann is investigated for exporting weapons without a licence, simply because his software left the country.
The source code is published as a book
MIT Press prints the full source. Books are protected speech, so the code walks out of the country legally - one of the sharpest protest moves in software history.
The case is dropped
The investigation closes with no charges. The episode helps end the era of treating encryption as a weapon.
OpenPGP goes to the IETF
An open working group is formed so anyone can build compatible software without licensing the original program.
RFC 2440 defines the OpenPGP message format
The exact shape of keys, signatures and encrypted messages becomes a public standard.
GnuPG 1.0 ships
A complete free-software implementation. It becomes the engine behind Linux package signing and countless privacy tools.
RFC 4880 - the version most tools still speak
The refresh that today's ecosystem is built on, from mail plugins to package managers.
RFC 9580 modernises the crypto
New key formats and authenticated encryption bring OpenPGP in line with current best practice, more than thirty years after version 1.0.
Thirty years on, the same format still carries confidential tips to newsrooms, signs the software updates on millions of servers, and protects mail for people who cannot afford to be read. Not bad for a program written to protest a bill.
Your privacy is guaranteed by design
Every operation described on this page runs inside your browser. Keys are generated on your device and stored there; nothing you type, encrypt or decrypt is sent to our servers. The code is open source, so you can check every claim yourself.
Frequently asked questions
What does PGP stand for?
PGP stands for Pretty Good Privacy. Phil Zimmermann released it in 1991 as free software so ordinary people could encrypt their messages, and it became the worldwide standard for private email and file encryption.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared secret key to both lock and unlock, so both people must already have the same key. Asymmetric encryption uses a pair: a public key that can only lock, which you hand out freely, and a private key that can only unlock, which you keep. PGP uses both - asymmetric to protect a one-time symmetric key, symmetric for the message itself.
Why do I need a key pair?
Your public key is what other people use to lock messages so that only you can read them, and it is what proves your signature is genuine. Your private key is the only thing in the world that can unlock those messages. Without a key pair nobody can write to you privately and you cannot sign anything.
Can I encrypt a message without the recipient's public key?
No. Encryption locks the message with the recipient's public key, so you need that key first. Ask them to export it from their PGP app - a public key is safe to send over email or chat because it can only lock, never unlock.
What happens if I lose my private key?
Messages encrypted to that key can never be read again, by anyone. There is no reset and no recovery - that is exactly what makes the system trustworthy. Back up your private key and its passphrase somewhere safe.
Is PGP the same as OpenPGP and GPG?
PGP was the original program. OpenPGP is the open standard written from it (RFC 4880, modernised as RFC 9580). GPG, or GnuPG, is the best known free implementation of that standard. Kleopatra.app implements the same standard, so keys and messages are compatible with all of them.
Is PGP still secure today?
Yes. Modern OpenPGP with RSA 4096-bit or Curve25519 keys has no known practical break and is used by journalists, security researchers, Linux distributions to sign packages, and privacy-focused mail providers.