gpg -c fileencrypt symmetrically (with a passphrase)
gpg -d file.gpgdecrypt
gpg -e -s -r who fileencrypt for a recipient + sign
gpg --detach-sign -a filea detached signature
gpg --verify file.asc fileverify a signature
gpg --fingerprintyour keys' fingerprints
gpg --import pub.ascimport a public key
gpg --recv-keys KEYIDfetch a public key from a keyserver
gpg --export-secret-keys -a me > priv.ascBACKUP the private key (keep it safe!)
Overview
GPG (GnuPG) provides encryption and digital signatures. Uses: encrypting a
file, signing a release/commit, verifying a package/repository signature
(apt uses GPG for verification).
Like SSH, it's asymmetric: a public key for encrypting/
verifying, a private key for decrypting/signing.
bash
gpg --list-keys # public keys in the keyring
gpg --list-secret-keys --keyid-format long # private ones (+ long keyid)
Options
15
bash
gpg --full-generate-key # create a pair (choose type/size/expiry)
gpg --quick-generate-key "Name <you@mail>" ed25519 sign,encrypt 1y # quick
gpg --fingerprint you@mail # a fingerprint (verify it when exchanging keys!)
gpg --export -a you@mail > pub.asc # export the public key (ASCII with -a)
gpg --export-secret-keys -a you@mail > priv.asc # back up the private key (keep it safe!)
gpg --import pub.asc # import someone else's public key
gpg --send-keys KEYID # publish it to a keyserver
gpg --recv-keys KEYID # fetch someone else's from a keyserver
gpg --gen-revoke you@mail > revoke.asc # a revocation certificate (in case of compromise)
Option
What it does
Example
-c--symmetric
Encrypt symmetrically, using a passphrase, with no keys.
gpg -c secret.txt
-d--decrypt
Decrypt a file with your private key or passphrase.
gpg -d secret.txt.gpg
-e--encrypt
Encrypt with the recipient's public key (needs -r).
gpg -e -r friend@mail file
-r--recipientuser-id
Specify the recipient (by email or key id) for encryption.
gpg -e -r friend@mail file
--full-generate-key
Create a new key pair, choosing the type, size, and expiry.
gpg --full-generate-key
-s--sign
Sign together with encrypting.
gpg -e -s -r friend@mail file
--detach-sign
Produce a detached signature for a file.
gpg --detach-sign -a file
--verify
Verify a file's signature.
gpg --verify file.asc file
--fingerprint
Show the key's fingerprint — verify it when exchanging keys.
gpg --fingerprint you@mail
--export-a
Export a public key (-a for ASCII armor).
gpg --export -a you@mail > pub.asc
--import
Import someone else's public key from a file.
gpg --import pub.asc
--recv-keyskeyid
Fetch a public key from a keyserver by its id.
gpg --recv-keys KEYID
--gen-revoke
Create a revocation certificate — in advance, in case the key is compromised.
gpg --gen-revoke you@mail > revoke.asc
--clearsign
Sign text while keeping it readable (the signature stays inline).
gpg --clearsign message.txt
--export-secret-keys-a
Export a private key — keep the result as securely as the key itself. dangerous
gpg --export-secret-keys -a you@mail > priv.asc
Nothing found. Try a shorter query.
Recipes
1
Encryption and signing
bash
# symmetric (with a passphrase, no keys) — handy for backups
gpg -c secret.txt # → secret.txt.gpg (asks for a passphrase)
gpg --cipher-algo AES256 -c f # an explicit cipher
gpg -d secret.txt.gpg # decrypt (output to stdout)# asymmetric (for a recipient)
gpg -e -r friend@mail file # encrypt with the recipient's public key
gpg -e -s -r friend@mail file # encrypt AND sign
gpg -d file.gpg > file # decrypt with your own private key# signing and verification
gpg --detach-sign -a file # a separate ASCII signature → file.asc
gpg --verify file.asc file # verify the signature
gpg --clearsign message.txt # an inline signature (readable text)
Troubleshooting
5
SymptomCause and fix
gpg: decryption failed: No secret key
There's no private key for this recipient (it was encrypted for a different
key), or the key isn't imported. gpg --list-secret-keys.
Can't check signature: No public key
The author's public key is missing. Import it (gpg --import/--recv-keys
KEYID), then --verify. Verify the fingerprint (--fingerprint) over a
trusted channel.
Forgot the private key's passphrase
It cannot be recovered. If you have a revocation certificate, revoke the key;
otherwise generate a new one and re-sign/re-encrypt.
Inappropriate ioctl for device (in scripts/CI)
GPG can't prompt for a passphrase (no TTY). Use --batch --pinentry-mode
loopback --passphrase-file pass.txt, or configure gpg-agent.
WARNING: ... not certified with a trusted signature
The key is imported but not trusted. The signature is valid, there's just no
"web of trust". If needed, gpg --edit-key KEYID → trust.
Danger zone
2
Losing the private key or its passphrase
There's no recovering encrypted data without the private key (or its
passphrase) — this isn't "forgotten but there's a workaround", it's
cryptographically impossible. Right after generating a pair, run gpg
--gen-revoke (a revocation certificate) and gpg --export-secret-keys (a
backup of the private key), and store both away from your working machine.
gpg --export-secret-keys into a shared channel
An exported private key is the key itself in text form (ASCII armor makes it
look like a harmless text file). Sending it to a chat/ticket/public repository
is the same as publishing the password to everything that key protects.
See also
ssh-keys — Key generation, authorized_keys, ssh-agent, permissions on .ssh files.
apt — Installing, upgrading, and removing packages on Debian/Ubuntu; apt and dpkg.
openssl-tls — Checking and issuing certificates — openssl for diagnostics, certbot for Let's Encrypt.