A pretty good primer on PGP

Here’s my guide on how to set up and use PGP via Gnu Privacy Guard (GPG) to create keys, sign messages, add other’s public keys, and verify the integrity of their messages. I couldn’t find any simple instructions on how to use it, so I decided to write my own that is easier to understand.

I’ll assume that you’re using Debian Linux or a derivative, since this blog post is meant for beginners, and Ubuntu is typically what people start out with.

Install GNU Privacy Guard

This command installs gnupg which is the Debian package for GNU Privacy Guard:

sudo apt install gnupg -y

Generate a new key

Now we need to create a key.

gpg --full-gen-key

This will give you a list of options. Here’s my recommendation:

• Press Enter to accept the default: ECC (sign and encrypt) *default*).
• Press Enter to accept the default: (1) Curve 25519 *default*
• The expiration date is up to you, but I recommend a year. Type 1y and press Enter.

Now, it wil ask you for a real name. I recommend using a pseudonym, but your real name will also work. You must put something there or it will throw warnings.

It will also ask you for an email address. I recommend leaving it blank unless you need to use it with software like Git or Thunderbird, but a valid email works.

Feel free to leave the comment field blank, or add one if you’d like, up to you.

Type the letter O and it will give you a prompt to create a password.

Type a strong password since this will be the thing that secures your key. Don’t reuse passwords from other accounts. Then press continue or Enter.

Congrats! You now have a PGP key!

Extracting your public key

You should now have output that looks something like this:

pub   ed25519 2026-07-05 [SC] [expires: 2027-07-05]
      8825EED66CB6BFAFF189A16414D8FABEF88E3A88
uid                      no
sub   cv25519 2026-07-05 [E] [expires: 2027-07-05]

Chances are, you want to be able to share your public key with someone else. To do this, you need to generate a public key file.

Type the following, but replace FINGERPRINT with whatever string you got under the “pub” section (which is known as a key fingerprint).

gpg --armor --export FINGERPRINT > pubkey.asc

This is now saved to the file called pubkey.asc. To view the contents of the file, type cat pubkey.asc. You can share this with friends, a upload to a key server, or put it on your website.

Revoking your key

You may need to revoke your GPG keys at some point, either due to compromise, device seizure, or some other externality. Make sure to print this out or keep it on an offline medium like a flash drive. You should NOT store this on your main machine.

gpg --output revocation.crt --gen-revoke FINGERPRINT

Note: This command is interactive. Follow the prompts.

If you need to revoke your key later:

1. Import the certificate: gpg --import revocation.crt
2. Send the update to key servers: gpg --send-keys FINGERPRINT
3. Or re-distribute the updated public key manually. Others won’t know your key is revoked unless they fetch the updated version.

Signing data

First we need some data to sign, so create a new text file (you can use nano command to do this), enter something, then save it.

The following command will let you sign a message and attach its signature inside of the file. This is great for text, but not great for pictures or data that relies on the formatting of the data within. Make sure to replace FILENAME with the actual name of your file or you’ll just get junk.

gpg --clearsign FILENAME

To generate the signature and store it separately, you can type the following:

gpg --detach-sig FILENAME

Importing another’s public key

You probably want to be able to verify another person’s message to know if it’s a successful match for their key. This is useful because it proves the authenticity and integrity of the data, basically that the person who signed it is the person who holds the private key that you trust.

To do this, type the following, but replace THEIRKEY.asc with the actual filename.

gpg --import THEIRKEY.asc

Verifying data

The main purpose of PGP is to be able to verify the integrity of data, so lets do that.

To verify someone’s data, type the following, but make sure to replace SIGFILE with the signature file and FILENAME with the name of the file to verify.

gpg --verify SIGFILE FILENAME

If the result ends with “Good signature from” followed by their name, the data hasn’t been tampered with.

CRITICAL WARNING: This only proves the data was signed by whoever holds the corresponding private key. It does NOT prove the key belongs to the person you expect. You must independently verify the key’s fingerprint (the long string under ‘pub’) with the sender via a trusted channel (like Signal or in-person) to prevent impersonation attacks.