Skip to main content
MI Support IT logo

IT security

What is PGP?

PGP encrypts and signs email and files using key pairs. See how the OpenPGP standard works, and when it is the right choice today.

In short

PGP (Pretty Good Privacy) is a program and a method for encrypting and signing email and files, created by Phil Zimmermann in 1991 and today standardised as OpenPGP, most recently in RFC 9580.

PGP combines the best of two worlds: the content is encrypted quickly with a symmetric one-time key, which is then encrypted with the recipient's public key, and the sender can also sign with their private key so the recipient can verify both the sender and the content. The result is true end-to-end encryption, where nobody along the way, not even the email provider, can read the message.

The most widespread implementation is the open source program GnuPG, which is also used to sign software across the entire Linux ecosystem. PGP's weakness has always been usability and key management, so for everyday secure business email most companies today choose S/MIME or portal solutions. MI Support IT advises on the right choice for secure email.

Back to the glossary

What is PGP?

PGP (Pretty Good Privacy) is the method, and originally the program, for encrypting and signing email and files using key pairs. Phil Zimmermann released it in 1991 as free software for everyone, which landed him in years of trouble with the US export authorities, who at the time classified strong encryption as weapons technology. Today the technology lives on as the open standard OpenPGP, most recently updated in RFC 9580, with the open source program GnuPG (GPG) as the most widespread implementation.

How does PGP work?

PGP is the textbook example of hybrid encryption: the combination of fast symmetric and flexible asymmetric encryption:

  1. The content is encrypted with a random symmetric one-time key (session key).
  2. The session key is encrypted with the recipient's public key. Only the recipient's private key can unwrap it.
  3. The sender can additionally sign with their private key, so the recipient can verify the sender and the content, a digital signature on top of the encryption.

The result is true end-to-end encryption: neither the email provider, the network nor a hacked server along the way can read the content, only the recipient.

Web of trust vs. certificates

PGP answers the trust question ("is that public key really yours?") differently from the certificate world: instead of central certificate authorities (CAs), PGP relies on a web of trust, where users sign each other's keys. It is decentralised and independent, but also the practical Achilles heel: keys must be exchanged, verified and maintained manually, and that scales poorly in a busy company. The alternative, S/MIME, uses X.509 certificates and a PKI and therefore fits better into centralised enterprise operations.

Where is PGP used today?

PGP still stands strong in three places: file encryption when exchanging sensitive data with external parties (for example fixed integrations where files are PGP-encrypted before transfer), software signing (the entire Linux and open source ecosystem verifies packages with PGP signatures) and journalism/whistleblowing, where independence from central authorities is the whole point. For everyday secure business email, most companies today choose S/MIME or secure portal solutions, which are easier to operate centrally, but the principle under the bonnet is the same.

How MI Support IT can help

We advise on the right tool for the job: PGP-based file encryption in integrations, S/MIME and secure email in Microsoft 365 and certificate management via PKI management, as part of your overall IT security. Contact us if you exchange sensitive data with the outside world and want your encryption put into a proper system.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting