The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Pretty Good Privacy (PGP) is a family of cryptographic software created by Philip Zimmermann and first released in 1991. It protects messages and files through encryption and can use digital signatures to help verify integrity and authenticity. RFC 1991 records the original release and these security services.
What does PGP stand for?
PGP stands for Pretty Good Privacy. The name originally referred to Zimmermann’s software, but it is also commonly used for the broader family of related implementations. The term is often used in reference to encrypted email, though PGP-related tools can also protect data files.
As an Amazon Associate I earn from qualifying purchases.
What is the difference between PGP and OpenPGP?
PGP is the name of the original software and the wider family. OpenPGP is the non-proprietary protocol and set of formats for messages, keys, and signatures derived from PGP. The Internet Engineering Task Force (IETF) established an OpenPGP working group in 1997, according to the OpenPGP organization.
The current OpenPGP specification consulted here is RFC 9580, published in August 2024. It obsoletes RFC 4880. The standard defines formats and methods; it does not endorse a particular application or guarantee that different programs will offer the same features or ease of use.
#1 Best Overall
- Used Book in Good Condition
How does PGP encryption work?
OpenPGP uses a hybrid encryption approach: symmetric encryption protects the message itself, while public-key cryptography protects the key used to encrypt that message. In the flow described by RFC 9580, a sender’s software creates a fresh session key for one object, encrypts the object with that key, and encrypts the session key for each recipient using that recipient’s public key.
- The sender encrypts the message or file with a randomly generated symmetric session key.
- The sender’s software encrypts that session key with each recipient’s public key, so the object can be opened by each intended recipient.
- A recipient uses the corresponding private key to recover the session key, then uses it to decrypt the object.
This design combines symmetric encryption for the data with public-key encryption for sharing access to the session key. RFC 9580 permits a message to be signed as well as encrypted.
Rank #2
What do PGP encryption and digital signatures each do?
Encryption and signatures address different security goals. Encryption is used for confidentiality: it is intended to prevent people without the necessary key from reading the protected content. A digital signature supports integrity and authentication checks, helping a recipient determine whether signed content has changed and whether it corresponds to the signing key.
Encrypting a message does not, by itself, prove who sent it. A sender can sign a message, encrypt it, do both, or use a signature without encryption. RFC 9580 describes both combined and signature-only uses. Its section 2 summarizes the standard’s purpose: “OpenPGP provides data confidentiality and integrity for messages and data files by using public key and/or symmetric encryption and digital signatures.”
What PGP does not manage for you
The OpenPGP specification defines how data and cryptographic operations are represented, but RFC 9580 leaves key storage and key management outside its scope. Users and the software they choose must handle matters such as protecting private keys and managing keys over time. The protocol also does not establish that a public key belongs to the person a user thinks it does; that depends on the identity-checking and key-management practices in use.
NIST’s glossary describes a web-of-trust model in which users manage and control those trust decisions, but its entry cites older RFCs and is explanatory context rather than the current technical standard: NIST glossary: OpenPGP. That glossary also notes that most mail clients do not support OpenPGP by default and that third-party plug-ins may be used. Because this is a dated statement, it should not be treated as a current survey of email applications.
Rank #4
- Used Book in Good Condition
What to check when choosing OpenPGP software
OpenPGP is a standard, not a specific email client or app. When comparing implementations, check the aspects that determine whether they fit your needs:
Recommended Free Tools
- Whether the software supports OpenPGP formats and interoperates with the other tools your recipients use.
- Whether it supports encryption, digital signatures, or both for your intended tasks.
- How it handles key creation, backup, revocation, and recovery.
- How well it fits your email or file workflow.
- Whether it supports current algorithms and the current specification, RFC 9580.
RFC 9580 defines formats and methods; it does not resolve how usable an implementation is or guarantee that separate products will work together in every case.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
