# What is GPG, and how do you encrypt a file with GPG? A practical gpg command tutorial URL: https://webvpn.org/encryption/gpg-encrypt-file/ Updated: 2026-09-10 What GPG is and how to encrypt a file with GPG: the gpg commands for passphrase and public-key encryption, decryption, signing and verification, with a short tutorial. GPG, the GNU Privacy Guard, is a free command-line program implementing the OpenPGP standard for encrypting, signing and verifying files and messages. To encrypt a file with a passphrase, run gpg -c filename, which produces filename.gpg protected with AES-256; to encrypt a file for someone else, run gpg -e -r their@email filename after importing their public key, and only their private key can open it. Decryption is gpg -d filename.gpg or gpg -o output filename.gpg in either case. GPG is present on nearly every Linux system, easy to install elsewhere, and does more than email. This tutorial covers what GPG is, the commands for symmetric and public-key file encryption, decrypting, signing and verifying, encrypting multiple files, the options worth knowing, and the habits that keep encrypted files actually secure. ## What GPG is GnuPG is the free software implementation of OpenPGP, the standard behind PGP, as the PGP guide on this site explains. The program is called gpg. It manages a keyring of your own keys and others' public keys, and performs the four core operations: encrypt, decrypt, sign, verify. It works on files of any type and size, and on text piped through it. Graphical tools such as Kleopatra and Seahorse are front-ends to the same program; the PGP tools guide on this site covers them. This tutorial uses the command line, which is the same on Linux, macOS and Windows once GnuPG is installed. Check it is present with gpg --version. If not, install it through your distribution's package manager, Homebrew on macOS, or the Gpg4win package on Windows. ## Symmetric encryption: a file with a passphrase The simplest use needs no keys at all. gpg -c document.pdf GPG prompts for a passphrase twice and writes document.pdf.gpg. The -c option means symmetric encryption; modern GnuPG uses AES-256 and a slow key derivation function to turn your passphrase into the key, following the pattern described in the symmetric encryption guide. The original file is left in place; delete it yourself if the plaintext should not remain. To decrypt: gpg -o document.pdf -d document.pdf.gpg GPG asks for the passphrase and writes the original. Without -o, the decrypted content goes to the terminal, which is fine for text and useless for a PDF. Symmetric encryption suits files you keep for yourself, backups, and files sent to someone with whom you can share a passphrase over a separate channel. The strength is entirely the passphrase's; use a long one. ## Public-key encryption: a file for a specific person To encrypt a file that only a particular recipient can open, you need their public key. Import it from a file they gave you: gpg --import their-key.asc Verify the fingerprint with them, as the how-to-use-PGP guide on this site insists, then encrypt: gpg -e -r their@email.example document.pdf The -e option means encrypt with public keys and -r names the recipient; GPG finds the key by email address or key ID. The output is document.pdf.gpg, readable only with the recipient's private key. Repeat -r for several recipients, and add -r your@email.example if you want to be able to open it yourself later; otherwise you cannot. The recipient decrypts with the same command as before: gpg -o document.pdf -d document.pdf.gpg GPG recognises the file was encrypted to their key and asks for their passphrase. ## Signing and verifying Signing proves a file came from you and was not altered. To sign and encrypt together: gpg -s -e -r their@email.example document.pdf The recipient sees the signature status when decrypting. To sign without encrypting, for a file anyone may read but should be able to verify: gpg --detach-sign document.pdf This writes document.pdf.sig. Anyone with your public key verifies with: gpg --verify document.pdf.sig document.pdf Detached signatures are how software projects sign releases, and verifying them before installing downloaded software is one of the most useful everyday uses of GPG. ## Text-friendly output By default GPG writes binary files. For pasting into email or chat, add -a for ASCII armour, which produces a text block beginning with -----BEGIN PGP MESSAGE----- and a .asc extension: gpg -a -c notes.txt Decryption is unchanged. ## Encrypting several files GPG encrypts one file at a time. For several, archive them first and encrypt the archive: tar czf project.tar.gz project/ gpg -c project.tar.gz This also hides the file names and structure, which encrypting each file separately would reveal. Delete the unencrypted archive after checking the encrypted one opens. ## Options worth knowing - -o filename sets the output file name. - --cipher-algo AES256 forces AES-256 for symmetric encryption; modern versions default to it. - --s2k-mode 3 --s2k-count 65011712 increases the passphrase-stretching cost on older versions. - --list-keys and --list-secret-keys show what is on your keyring. - --export -a your@email.example > mykey.asc exports your public key to share. - --gen-key or --full-generate-key creates a new key pair. - --batch --yes --passphrase-file supports scripting; keep the passphrase file protected and prefer an agent for interactive use. ## A seven-point checklist for safe GPG file encryption - Use a long, unique passphrase for symmetric encryption; the cipher cannot compensate for a short one. - Verify a recipient's key fingerprint before encrypting to it the first time. - Include yourself as a recipient if you will need to read the file later. - Securely delete or overwrite the plaintext original after confirming the encrypted file decrypts. - Share a symmetric passphrase over a different channel than the file. - Test decryption before deleting anything or sending the only copy. - Keep your own private key backed up offline; encrypted files are as recoverable as the key. ## Where GPG fits alongside other tools GPG is the right tool when the recipient has a PGP key, when you want signatures, or when you are already using PGP for email. For simple passphrase encryption of files, age is a smaller modern alternative with fewer options to get wrong, and 7-Zip suits archives on Windows, as the file encryption guides on this site describe. For a container that mounts like a drive, VeraCrypt. For an entire disk, the operating system's full-disk encryption. GPG's advantage is that it is already there, scriptable, and speaks a format everyone can open. ## What the GnuPG project and system administrators say The commands above follow the software's documentation and standard practice. The GnuPG project documents -c for symmetric encryption, -e -r for public-key encryption, and -s and --detach-sign for signatures, and describes its current defaults of AES-256 and a strong string-to-key function for passphrases. System administrators and backup practitioners describe GPG as the standard tool for encrypting backups and secrets on servers because it is present everywhere, scriptable, and produces files that any OpenPGP implementation can read years later. Software distributions and security projects publish detached GPG signatures for their releases and document verification as the intended way for users to confirm downloads are genuine. ## One command, then build from it Encrypt a test file with gpg -c, decrypt it, and delete both. That is the whole loop, and everything else in this tutorial is a variation on it: a recipient key instead of a passphrase, a signature alongside, an archive instead of a single file. With the loop in your hands, every file you send or store can be one command away from unreadable. ## FAQ Q: What is GPG? A: GPG, or GnuPG, is the GNU Privacy Guard, a free implementation of the OpenPGP standard. It is a command-line program for encrypting, decrypting, signing and verifying files and messages, and for managing keys. It is installed on most Linux systems and available for Windows and macOS. Q: How do I encrypt a file with GPG using a password? A: Run gpg -c filename. GPG asks for a passphrase and writes filename.gpg encrypted with AES. Anyone with the passphrase can decrypt it with gpg filename.gpg. This is symmetric encryption and needs no keys. Q: How do I encrypt a file with GPG for someone else? A: Import their public key, then run gpg -e -r their@email filename. GPG encrypts to their key and writes filename.gpg, which only their private key can decrypt. Add -s to sign it as well, so they can verify it came from you. Q: How do I decrypt a GPG file? A: Run gpg -d filename.gpg to write the decrypted content to standard output, or gpg -o output filename.gpg to write it to a file. GPG asks for the passphrase or uses your private key automatically depending on how the file was encrypted. Q: Is GPG file encryption secure? A: Yes, when used with a strong passphrase or a verified recipient key. Modern GnuPG defaults to AES-256 and a strong key derivation function. The weak points are short passphrases, unverified keys, leaving plaintext copies behind, and sharing the passphrase over the same channel as the file.