What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To use OpenPGP in Thunderbird, choose a personal key for each sending account or identity, obtain and verify a public key for every recipient, then turn on encryption for each message you want to protect. Back up your secret key before relying on it: without that key, you may not be able to read messages encrypted to you, including saved messages.
Before you start: what OpenPGP encryption needs
You need a personal OpenPGP key configured in Thunderbird and a suitable public key for every recipient of an encrypted message. Encryption is a deliberate choice when composing; it is not automatically applied to every message. Mozilla’s OpenPGP overview and FAQ explains these prerequisites and the key-exchange options.
As an Amazon Associate I earn from qualifying purchases.
OpenPGP and S/MIME are separate encryption technologies. Thunderbird cannot combine them in one encrypted message, so all recipients of a particular message need to be reachable using the same technology.
Set up your personal key
-
In Thunderbird, open Account Settings, select the email account or identity you want to configure, and open End-To-End Encryption.
#1 Best Overall
Yubico - YubiKey 5C NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified - Protect Your Online Accounts- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
-
Select Add Key…. Import an existing OpenPGP key if you already have one, or create a new key. An imported key must be unexpired and unrevoked, valid for digital signing and encryption, and include a user ID containing the email address configured for that account. See Mozilla’s account setup instructions for the acceptance conditions.
-
Select the key as the personal key for that account or identity. Configure each account and identity separately if you use more than one.
-
Make a backup of the secret key and protect it with a strong password. Never send or publish the secret key. Thunderbird protects imported secret keys within the application; Mozilla recommends setting a Primary Password. See Mozilla’s introduction to end-to-end encryption for backup and cross-device guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Rank #2
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Using the same key on multiple devices
If you want to use the same OpenPGP identity on more than one device, Mozilla recommends generating the key once, backing it up, and importing that same key on the other devices rather than creating separate keys for each device.
Get and verify each recipient’s public key
You need a usable public key for every person in To, Cc, or Bcc before Thunderbird can encrypt a message to the full recipient list. Keys may arrive as mail attachments, through Autocrypt headers, from web servers, or through WKD online discovery. Import the key using Thunderbird’s OpenPGP controls or Key Manager as appropriate. Mozilla describes these routes in its OpenPGP FAQ.
Before accepting or trusting a correspondent’s key, verify that it belongs to the person you intend to contact. Accepting a key without checking its identity can expose you to a person-in-the-middle attack: an attacker could supply a key that they control instead.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Compose and send an encrypted message
-
Start a message from the account or identity whose personal key you configured.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Open the message’s security or encryption controls and enable encryption. The exact composer control varies across Thunderbird versions, so use the current interface rather than relying on an older button label.
-
Check that every recipient in To, Cc, and Bcc has an available, suitable OpenPGP public key. A missing or invalid key can prevent sending an encrypted message, and every intended recipient must be covered.
Rank #4
Yubico - YubiKey 5 Nano C - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB, FIDO Certified - Protect Your Online Accounts (Nano USB-C)- POWERFUL SECURITY KEY: The YubiKey 5C Nano is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C Nano secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: The YubiKey 5C Nano is designed to stay plugged into your device via USB-C. Simply tap it to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
-
Send the message. If you also want recipients to check that it was signed with your key, enable digital signing as well. Signing does not conceal the message contents; encryption does.
Test the configuration and preserve access
Send an encrypted message to yourself from the configured identity, retrieve it, and inspect Thunderbird’s security indication in the message header. You can optionally sign the test message too. This checks that the identity’s key is in use and that you can decrypt a message received by that identity.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Keep your secret-key backup protected and accessible to you. If you lose the secret key, messages encrypted to it may become unreadable, including messages you have archived. Mozilla’s OpenPGP FAQ also covers exporting and importing keys.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What OpenPGP does not hide
OpenPGP protects message contents, but it does not necessarily conceal email metadata. Sender and recipient names or addresses, the time sent, and information about the sending or receiving computers may remain visible; the subject may also be exposed. Mozilla outlines these limits in its end-to-end encryption introduction.
Special case: alias keys
Thunderbird’s OpenPGP alias-key feature can override the usual match between a public key and an email address. Mozilla warns that a company-wide shared key may allow the company’s server to decrypt a message and forward it in plaintext. That arrangement has a different trust boundary from encrypting to an individual correspondent and is not complete end-to-end encryption. See Mozilla’s alias-key guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
