GnuPG
FreeThe long-standing standard for encryption and signatures
The free implementation of the OpenPGP standard, used to encrypt files and email and to sign data digitally. It is the universal tool for verifying software downloads — nearly every open-source project signs releases with it — and the infrastructure behind end-to-end encrypted email. On Windows it is usually installed via Gpg4win, which includes the Kleopatra graphical interface.
Why we picked it
GnuPG is not software that makes you safer by installing it — it is infrastructure. You may never have used it directly, but you have almost certainly depended on it:
- The signature file published alongside a Linux ISO or an open-source installer is verified with GnuPG. That is the only reliable way to confirm that what you downloaded was not swapped in transit.
- The green "Verified" badge on a Git commit is a GPG signature underneath.
- End-to-end encrypted mail in Thunderbird and package repository verification across distributions all rest on it.
At its core is asymmetric cryptography: you hold a key pair, hand out the public key freely and guard the private one. Others encrypt with your public key and only your private key opens it; you sign with the private key and anyone can verify with the public one that the message is genuinely yours and unaltered.
How it is actually installed:
- Windows: use Gpg4win, which bundles GnuPG with the Kleopatra GUI, so generating keys, encrypting files and verifying signatures never requires a terminal.
- macOS: GPG Suite, or
brew install gnupg. - Linux: almost always preinstalled; the command is
gpg.
The honest caveats:
- It is hard to learn. Keys, subkeys, the web of trust, keyservers, expiry dates, revocation certificates — this conceptual apparatus was designed in the 1990s and is unfriendly to ordinary users, which is precisely why thirty years have not made it mainstream. If you only want to encrypt a few files, VeraCrypt or Cryptomator are far simpler.
- Lose the private key and the encrypted data is gone forever. After generating a key, do two things immediately: back the private key up to offline media, and create a revocation certificate stored separately.
- Encrypted email leaks metadata. PGP encrypts the body; recipients, subject line and timestamps remain in the clear. For genuinely private conversation, Signal or SimpleX are the modern answers.
When you genuinely need it: verifying that a download is authentic, signing commits, exchanging encrypted mail with a small fixed group, and archiving encrypted files long-term. For those jobs it still has no replacement.