GnuPG (GPG) — Encryption & Signing Tool

Q: What is the difference between public and private keys in GPG?

Public keys (--list-keys) are used to encrypt data and verify signatures — they can be safely distributed to anyone. Private keys (--list-secret-keys) are used to decrypt data and create signatures — they must be kept strictly confidential. Always back up private keys to offline storage and protect them with a strong passphrase.

Q: What does the --armor option do?

The --armor (-a) option produces ASCII-armored output, converting binary data to Base64 text. This is essential when transferring keys or ciphertext through email or text-based channels. Without --armor, GPG outputs binary files which are more compact but not suitable for text transmission.

Q: How do I back up my GPG private keys?

Export your private keys with: gpg --export-secret-keys --armor your@email.com > private-key.asc. Save the file to offline encrypted storage (e.g., USB drive). Also export the trust database: gpg --export-ownertrust > trust.asc. To restore: gpg --import private-key.asc and gpg --import-ownertrust < trust.asc.

Q: What is a revocation certificate and why should I generate it immediately?

A revocation certificate (--gen-revoke) is used to declare that a public key is no longer trusted when the private key is lost or compromised. You should generate it immediately after creating a key pair and store it offline, because once the private key is lost, you cannot generate a revocation certificate without it. Print a paper copy and keep it in a safe location.

Q: What is the difference between symmetric (-c) and public key (--encrypt) encryption?

Symmetric encryption (gpg -c file) uses a single passphrase to both encrypt and decrypt, suitable for protecting personal files. Public key encryption (gpg -e -r recipient file) uses the recipient's public key to encrypt; only the holder of the corresponding private key can decrypt. Public key encryption is ideal for secure multi-party communication, while symmetric encryption is faster but harder to distribute keys.

GnuPG (GPG) is the open-source implementation of the OpenPGP standard for encryption, signing, and key management. This cheatsheet covers the complete workflow from key generation, import/export to file encryption/decryption, signing/verification, along with keyserver operations and advanced configuration.

Updated: 2026-07-17·30 commands

Overview

GnuPG (GPG) is a complete and free implementation of the OpenPGP standard. It allows you to encrypt and sign your data and communications. This cheatsheet covers key management, encryption, signing, and verification.

Quick Start

``bash gpg --gen-key # Generate a new key pair gpg --list-keys # List public keys gpg --encrypt -r user file.txt # Encrypt a file``

Refer to the command table below for detailed usage.

Key Mgmt(18)

Command	Level	Example
`gpg --gen-key` Quickly generate a new GPG key pair (interactive)	Basic	`gpg --gen-key`
`gpg --full-generate-key` Generate a key pair with full control (type, length, expiry)	Intermediate	`gpg --full-generate-key`
`gpg --list-keys` List all public keys	Basic	`gpg --list-keys`
`gpg --list-secret-keys` List all secret keys	Basic	`gpg --list-secret-keys --keyid-format LONG`
`gpg --export` Export a public key (binary format)	Basic	`gpg --export -o alice-pub.gpg alice@example.com`
`gpg --export --armor` Export a public key in ASCII-armored format	Basic	`gpg --armor --export alice@example.com`
`gpg --import` Import a key (public or private)	Basic	`gpg --import bob-pub.asc`
`gpg --send-keys` Send a key to a keyserver	Intermediate	`gpg --keyserver keys.openpgp.org --send-keys ABCD1234`
`gpg --recv-keys` Receive a key from a keyserver	Intermediate	`gpg --keyserver keys.openpgp.org --recv-keys ABCD1234`
`gpg --delete-keys` Delete a public key	Intermediate	`gpg --delete-keys alice@example.com`
`gpg --delete-secret-keys` Delete a secret key	Intermediate	`gpg --delete-secret-keys alice@example.com`
`gpg --export-secret-keys` Export secret keys (for backup)	Expert	`gpg --export-secret-keys --armor -o private-backup.asc alice@example.com`
`gpg --edit-key` Interactively edit a key (add UID, change expiry, set trust, etc.)	Expert	`gpg --edit-key alice@example.com`
`gpg --fingerprint` Display key fingerprint	Basic	`gpg --fingerprint alice@example.com`
`gpg --keyserver` Specify a keyserver	Intermediate	`gpg --keyserver hkps://keys.openpgp.org --search-keys alice@example.com`
`gpg --refresh-keys` Refresh all keys (fetch updates from keyserver)	Intermediate	`gpg --refresh-keys`
`gpg --list-sigs` List signatures on a key	Intermediate	`gpg --list-sigs alice@example.com`
`gpg --search-keys` Search for keys on a keyserver	Intermediate	`gpg --keyserver keys.openpgp.org --search-keys alice@example.com`

Encryption(6)

Command	Level	Example
`gpg --encrypt` Encrypt a file with a public key	Basic	`gpg -e -r alice@example.com secret.txt`
`gpg --decrypt` Decrypt a file	Basic	`gpg -d secret.txt.gpg`
`gpg -c` Symmetric encryption (use a passphrase instead of a public key)	Basic	`gpg -c myfile.txt`
`gpg --armor` Output in ASCII-armored format (for email and text transmission)	Basic	`gpg --armor -e -r bob@example.com data.txt`
`gpg -o` Specify output file	Basic	`gpg -o decrypted.txt -d secret.txt.gpg`
`gpg -r` Specify recipient (encrypt with their public key)	Basic	`gpg -e -r alice@example.com -r bob@example.com data.txt`

Signing(4)

Command	Level	Example
`gpg --sign` Sign a file (with compression)	Intermediate	`gpg -s document.txt`
`gpg --clearsign` Clear-sign a file (readable text with embedded signature)	Intermediate	`gpg --clearsign announcement.txt`
`gpg --detach-sign` Generate a detached signature file	Intermediate	`gpg --detach-sign --armor file.zip`
`gpg --verify` Verify a signature	Basic	`gpg --verify file.zip.asc file.zip`

Advanced(2)

Command	Level	Example
`gpg --trust-model` Set the trust model (always/pgp/classic/direct)	Expert	`gpg --trust-model always -e -r bob@example.com file.txt`
`gpg --gen-revoke` Generate a revocation certificate	Intermediate	`gpg --gen-revoke alice@example.com`

FAQ

What is the difference between public and private keys in GPG?

What does the --armor option do?

How do I back up my GPG private keys?

What is a revocation certificate and why should I generate it immediately?

What is the difference between symmetric (-c) and public key (--encrypt) encryption?

This cheatsheet is compiled from official tool documentation. Last updated: 2026-07-17.