← All cheat sheets

🌶 PGP

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

GPG (GNU Privacy Guard) is the free implementation of OpenPGP standard.
Most commands use 'gpg' or 'gpg2' depending on your system.

gpg [options] [files]
gpg --help                               # Show help
gpg --version                            # Show version and supported algorithms
man gpg                                  # Full manual

gpg --gen-key                            # Generate new key pair (interactive)
gpg --full-gen-key                       # Full key generation with all options
gpg --quick-gen-key "Name <email>"       # Quick key generation
gpg --quick-gen-key "Name <email>" rsa4096  # Quick with RSA 4096-bit
gpg --quick-gen-key "Name <email>" ed25519  # Quick with Ed25519 (modern)

# Generate key with specific parameters
gpg --full-gen-key --expert              # Expert mode (more algorithm choices)

# Recommended modern setup:
# - Primary key: Ed25519 (sign only)
# - Subkey: Cv25519 (encrypt)
# - Expiration: 1-2 years

gpg --list-keys                          # List all public keys
gpg --list-keys user@email.com           # List specific user's key
gpg -k                                   # Short form: list public keys
gpg --list-secret-keys                   # List private/secret keys
gpg -K                                   # Short form: list secret keys
gpg --list-sigs                          # List keys with signatures
gpg --fingerprint                        # Show key fingerprints
gpg --fingerprint user@email.com         # Fingerprint for specific key
gpg --list-keys --keyid-format long      # Show long key IDs
gpg --list-keys --keyid-format 0xlong    # Show key IDs with 0x prefix

gpg --edit-key KEY_ID                    # Interactive key editing
gpg --edit-key KEY_ID check              # Check key signatures
gpg --export-ownertrust                  # Export trust database
gpg --import-ownertrust file             # Import trust database

# Export public key
gpg --export -a "User Name" > public.asc           # ASCII armored
gpg --export KEY_ID > public.gpg                   # Binary format
gpg --export --armor user@email.com                # To stdout
gpg --export -a KEY_ID > public_key.asc            # By key ID

# Export secret/private key (PROTECT THIS!)
gpg --export-secret-keys -a KEY_ID > private.asc   # ASCII armored
gpg --export-secret-keys KEY_ID > private.gpg      # Binary format
gpg --export-secret-subkeys -a KEY_ID > subkeys.asc  # Subkeys only

# Export specific subkey
gpg --export-secret-subkeys SUBKEY_ID! > subkey.gpg

gpg --import public_key.asc              # Import public key
gpg --import private_key.asc             # Import private key
gpg --import keyfile.gpg                 # Import from binary file
curl URL | gpg --import                  # Import from URL
gpg --fetch-keys URL                     # Fetch and import from URL

gpg --delete-key KEY_ID                  # Delete public key
gpg --delete-secret-key KEY_ID           # Delete private key
gpg --delete-secret-and-public-key KEY_ID  # Delete both

# Encrypt for recipient
gpg -e -r recipient@email.com file.txt             # Encrypt file
gpg --encrypt --recipient KEY_ID file.txt          # Long form
gpg -e -r user1@email.com -r user2@email.com file  # Multiple recipients
gpg -e -a -r recipient file.txt                    # ASCII armored output

# Encrypt with specific output file
gpg -e -r recipient -o encrypted.gpg file.txt

# Symmetric encryption (password only, no keys)
gpg -c file.txt                          # Symmetric encrypt
gpg --symmetric file.txt                 # Long form
gpg -c --cipher-algo AES256 file.txt     # Specify cipher

# Encrypt and sign
gpg -e -s -r recipient file.txt          # Encrypt and sign
gpg --encrypt --sign --recipient KEY_ID file.txt

# Encrypt for self (backup)
gpg -e -r YOUR_KEY_ID file.txt

gpg -d file.txt.gpg                      # Decrypt to stdout
gpg --decrypt file.txt.gpg               # Long form
gpg -d -o file.txt file.txt.gpg          # Decrypt to file
gpg --output file.txt --decrypt file.gpg # Long form with output
gpg -d encrypted.asc                     # Decrypt ASCII armored

# Decrypt and verify signature
gpg -d signed_encrypted.gpg              # Automatically verifies

# Create detached signature
gpg -b file.txt                          # Binary detached signature
gpg --detach-sign file.txt               # Long form
gpg -ab file.txt                         # ASCII armored detached sig
gpg --armor --detach-sign file.txt       # Long form

# Create signed file (signature embedded)
gpg -s file.txt                          # Binary signed file
gpg --sign file.txt                      # Long form
gpg --clear-sign file.txt                # Cleartext signature (readable)
gpg --clearsign file.txt                 # Alternative spelling

# Sign with specific key
gpg -u KEY_ID -s file.txt                # Specify signing key
gpg --local-user KEY_ID --sign file.txt  # Long form

# Sign and encrypt
gpg -se -r recipient file.txt            # Sign and encrypt

gpg --verify file.txt.sig                # Verify detached signature
gpg --verify file.txt.sig file.txt       # Verify with explicit file
gpg --verify signed_file.gpg             # Verify embedded signature
gpg -d signed_file.gpg                   # Decrypt and verify
gpg --verify message.asc                 # Verify cleartext signature

# Search for keys
gpg --search-keys user@email.com         # Search keyserver
gpg --keyserver hkps://keys.openpgp.org --search-keys user@email.com

# Download/receive keys
gpg --recv-keys KEY_ID                   # Receive key from server
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys KEY_ID
gpg --recv-keys 0xKEY_ID                 # With 0x prefix

# Upload/send keys
gpg --send-keys KEY_ID                   # Send key to server
gpg --keyserver hkps://keys.openpgp.org --send-keys KEY_ID

# Refresh keys (update from server)
gpg --refresh-keys                       # Refresh all keys
gpg --refresh-keys KEY_ID                # Refresh specific key

# Popular keyservers
# hkps://keys.openpgp.org (recommended, email verification)
# hkps://keyserver.ubuntu.com
# hkps://pgp.mit.edu
# hkps://keys.gnupg.net

gpg --edit-key KEY_ID trust              # Set trust level interactively

# Trust levels:
# 1 = Don't know
# 2 = I do NOT trust
# 3 = I trust marginally
# 4 = I trust fully
# 5 = I trust ultimately (only for your own keys)

gpg --edit-key KEY_ID sign               # Sign someone's key (certify)
gpg --edit-key KEY_ID lsign              # Local signature (not exported)
gpg --edit-key KEY_ID tsign              # Trust signature
gpg --check-trustdb                      # Update trust database
gpg --update-trustdb                     # Rebuild trust database

gpg --edit-key KEY_ID                    # Enter edit mode

# Commands in edit mode:
# help      - Show available commands
# list      - List key and subkeys
# key N     - Select subkey N
# adduid    - Add user ID
# deluid    - Delete user ID
# addkey    - Add subkey
# delkey    - Delete subkey
# expire    - Change expiration
# passwd    - Change passphrase
# revkey    - Revoke key
# save      - Save and exit
# quit      - Exit without saving

# Add new subkey
gpg --edit-key KEY_ID addkey

# Change expiration
gpg --edit-key KEY_ID expire

# Change passphrase
gpg --edit-key KEY_ID passwd

# Generate revocation certificate (DO THIS AFTER KEY CREATION!)
gpg --gen-revoke KEY_ID > revoke.asc
gpg --output revoke.asc --gen-revoke KEY_ID

# Revoke a key (import revocation certificate)
gpg --import revoke.asc

# Revoke a subkey
gpg --edit-key KEY_ID
# > key 1 (select subkey)
# > revkey
# > save

# Config file location
~/.gnupg/gpg.conf                        # Main config
~/.gnupg/gpg-agent.conf                  # Agent config

# Useful gpg.conf options:
# default-key KEY_ID                     # Default signing key
# encrypt-to KEY_ID                      # Always encrypt to self
# armor                                  # Always ASCII output
# no-emit-version                        # Don't show version
# keyserver hkps://keys.openpgp.org      # Default keyserver
# keyserver-options auto-key-retrieve    # Auto-fetch keys
# personal-cipher-preferences AES256 AES192 AES
# personal-digest-preferences SHA512 SHA384 SHA256
# cert-digest-algo SHA512

# Reload agent after config changes
gpg-connect-agent reloadagent /bye

gpg-agent --daemon                       # Start agent
gpgconf --kill gpg-agent                 # Stop agent
gpgconf --reload gpg-agent               # Reload agent
gpg-connect-agent reloadagent /bye       # Reload via socket
echo "RELOADAGENT" | gpg-connect-agent   # Alternative reload

# Agent config (~/.gnupg/gpg-agent.conf):
# default-cache-ttl 600                  # Cache passphrase 10 min
# max-cache-ttl 7200                     # Max cache 2 hours
# pinentry-program /usr/bin/pinentry-gtk-2

# Batch encryption
for f in *.txt; do gpg -e -r recipient "$f"; done

# Batch decryption
for f in *.gpg; do gpg -d -o "${f%.gpg}" "$f"; done

# Batch signing
for f in *.tar.gz; do gpg -b "$f"; done

# Non-interactive operations
gpg --batch --yes --passphrase "pass" -d file.gpg
gpg --batch --pinentry-mode loopback --passphrase "pass" -d file.gpg

gpg -a                                   # ASCII armor (short)
gpg --armor                              # ASCII armor (long)

# Armored output is base64 encoded, suitable for:
# - Email
# - Copy/paste
# - Text files
# - Web forms

# Binary output is smaller and faster for:
# - File storage
# - Automated processing

# List available algorithms
gpg --version                            # Shows supported algorithms

# Specify cipher for symmetric encryption
gpg -c --cipher-algo AES256 file         # AES-256
gpg -c --cipher-algo CAMELLIA256 file    # Camellia-256
gpg -c --cipher-algo TWOFISH file        # Twofish

# Specify digest for signing
gpg -s --digest-algo SHA512 file         # SHA-512
gpg -s --digest-algo SHA256 file         # SHA-256

# Modern recommended algorithms:
# Asymmetric: Ed25519 (sign), Cv25519 (encrypt), RSA-4096
# Symmetric: AES-256, Camellia-256
# Hash: SHA-512, SHA-256

gpg --card-status                        # Show card info
gpg --card-edit                          # Edit card settings
gpg --edit-key KEY_ID keytocard          # Move key to card

# Card edit commands:
# admin     - Enable admin commands
# passwd    - Change PIN
# name      - Set cardholder name
# generate  - Generate key on card
# fetch     - Fetch key from URL on card

# Backup entire GPG directory
tar -czf gpg-backup.tar.gz ~/.gnupg/

# Backup specific key
gpg --export-secret-keys -a KEY_ID > private-key.asc
gpg --export -a KEY_ID > public-key.asc
gpg --export-ownertrust > trust.txt

# Restore
gpg --import private-key.asc
gpg --import public-key.asc
gpg --import-ownertrust trust.txt

# Backup to paper (paperkey)
gpg --export-secret-keys KEY_ID | paperkey --output paper-backup.txt

# Encrypt file for someone
gpg -e -a -r recipient@email.com secret.txt

# Decrypt file sent to you
gpg -d secret.txt.asc > secret.txt

# Sign a release/file
gpg -ab release.tar.gz
# Creates release.tar.gz.asc (signature file)

# Verify downloaded file
gpg --verify file.tar.gz.asc file.tar.gz

# Encrypt password/credentials file
gpg -c -a passwords.txt

# Sign git commits (configure git)
git config --global user.signingkey KEY_ID
git config --global commit.gpgsign true

# Export public key for sharing
gpg --export -a "Your Name" > my_public_key.asc

# Check GPG installation
gpg --version
which gpg

# Test encryption/decryption
echo "test" | gpg -e -r YOUR_KEY_ID | gpg -d

# Debug output
gpg -v --decrypt file.gpg               # Verbose
gpg -vv --decrypt file.gpg              # More verbose
gpg --debug-all --decrypt file.gpg      # Full debug

# Fix permissions
chmod 700 ~/.gnupg
chmod 600 ~/.gnupg/*

# Clear passphrase cache
gpg-connect-agent reloadagent /bye

# "No secret key" error
gpg --list-secret-keys                   # Check if key exists
gpg -K KEY_ID                            # Check specific key

# "Unusable public key" error
gpg --edit-key KEY_ID                    # Check key status
# Look for expired/revoked keys

1. Use strong passphrase for private key
2. Generate revocation certificate immediately after key creation
3. Store revocation certificate securely offline
4. Use subkeys for daily operations, keep primary key offline
5. Set expiration dates on keys (1-2 years)
6. Verify key fingerprints through secure channel
7. Back up private keys securely
8. Use hardware token (YubiKey) for high-security needs
9. Keep GPG software updated
10. Don't share private keys

gpg --gen-key                    # Generate key pair
gpg -k                           # List public keys
gpg -K                           # List private keys
gpg --fingerprint KEY_ID         # Show fingerprint
gpg -e -r recipient file         # Encrypt
gpg -d file.gpg                  # Decrypt
gpg -s file                      # Sign
gpg --verify file.sig            # Verify signature
gpg --import key.asc             # Import key
gpg --export -a KEY_ID           # Export public key
gpg --send-keys KEY_ID           # Upload to keyserver
gpg --recv-keys KEY_ID           # Download from keyserver