In short. PGP is a way to encrypt and sign email with a key pair. Today “PGP” usually means the open OpenPGP standard [1]: email apps, browser extensions and some email services support it. PGP hides the text and attachments of a message, but not the addresses or the time, and in its classic form not the subject either.
Where PGP comes from
The program Pretty Good Privacy appeared in 1991; its author is Phil Zimmermann [2]. Its format later became the open OpenPGP standard: first RFC 4880 in 2007 [3], replaced by RFC 9580 in 2024 [1]. Since June 2026, OpenPGP also has post-quantum algorithms, in RFC 9980 [4].
How it works
- A key pair. You give your public key to anyone who wants to write to you encrypted. You keep the private key to yourself.
- Encryption. The sender encrypts a message with your public key. Only your private key can decrypt it.
- Signatures. You sign a message with your private key, and the recipient checks it with your public key. A signature shows the message is from you and was not changed on the way.
- A key fingerprint. A short string you can compare with the key’s owner: in person, by phone, over another channel. Without that, you might encrypt to a key someone else slipped you.
A PGP message is usually packaged per the PGP/MIME standard [5]: the encrypted content and the signature travel as separate parts of the message.
How to find someone’s key
- Ask for it directly. The most reliable way, as long as you compare fingerprints afterwards.
- Key servers. You can publish your public key there and fetch other people’s. On some servers anyone can upload a key under someone else’s name, so compare fingerprints anyway.
- Automatic lookup. Some email services publish their users’ keys so that apps can find them on their own.
PGP or S/MIME
| OpenPGP | S/MIME | |
|---|---|---|
| Who issues keys | you do | a certificate authority, usually via a certificate |
| Where it is common | individuals, journalists, developers | companies and government bodies |
| How you verify the other side | compare the key fingerprint | trust the certificate authority |
| Standard | RFC 9580 [1] | RFC 8551 [6] |
What PGP does not hide
- Addresses and time. Mail cannot be delivered without them.
- The subject line. Classic PGP leaves the subject readable. A standard for protecting headers was published in 2025 [7], but not every app supports it yet.
- The fact that you correspond. Who writes to whom, and when, is visible to mail servers. More in Email metadata.
One more thing: if you lose your private key and have no backup, old encrypted messages can no longer be opened.
How to start
- An email app. Thunderbird has had OpenPGP built in since version 78 [8].
- Webmail. A browser extension such as Mailvelope [9].
- The command line. GnuPG, a free PGP program [10]. By default it follows RFC 4880 [10] and its own specification, LibrePGP [11], not the newest version of the standard (RFC 9580) or post-quantum keys per RFC 9980.
Step-by-step instructions are in How to send an encrypted email.
PGP and Methmail
Methmail will be OpenPGP-compatible: you will be able to exchange encrypted email with PGP users, add your contacts’ public keys and export your own keys in OpenPGP format. Not every PGP program supports post-quantum keys yet; for those recipients Methmail will use a compatible format and tell you so. Methmail will check your contacts’ keys against a public key log: a swapped key can be detected but not ruled out in advance. The other limits are under What Methmail won’t be able to do.
Sources
- RFC 9580: OpenPGP. IETF, July 2024. https://www.rfc-editor.org/rfc/rfc9580
- Wikipedia: Pretty Good Privacy. https://en.wikipedia.org/wiki/Pretty_Good_Privacy
- RFC 4880: OpenPGP Message Format. IETF, November 2007. https://www.rfc-editor.org/rfc/rfc4880
- RFC 9980: Post-Quantum Cryptography in OpenPGP. IETF, June 2026. https://www.rfc-editor.org/rfc/rfc9980
- RFC 3156: MIME Security with OpenPGP. IETF, August 2001. https://www.rfc-editor.org/rfc/rfc3156
- RFC 8551: S/MIME Version 4.0 Message Specification. IETF, April 2019. https://www.rfc-editor.org/rfc/rfc8551
- RFC 9788: Header Protection for Cryptographically Protected Email. IETF, August 2025. https://www.rfc-editor.org/rfc/rfc9788
- Mozilla Wiki: Thunderbird OpenPGP. https://wiki.mozilla.org/Thunderbird:OpenPGP
- Mailvelope. https://mailvelope.com/
- GnuPG. https://gnupg.org/
- LibrePGP. https://librepgp.org/