Asymmetric GPG Encryption

GPG encryption

1. Check if you already have a GPG key pair

gpg --list-secret-keys --keyid-format=long

2. If not, generate one

gpg --full-generate-key

Pick RSA and RSA (default), 4096 bits, set an expiration if you want, and use your real email — it’s the identifier GPG uses to find your key.

3. Encrypt the file to your own key (so only you can decrypt it)

gpg --encrypt --recipient your@email.com secret.txt

This produces secret.txt.gpg (binary). If you want an ASCII-safe version to paste into git/email, add --armor:

gpg --encrypt --armor --recipient your@email.com secret.txt

This produces secret.txt.asc.

4. Decrypt / view it

gpg --decrypt secret.txt.gpg

GPG will prompt for your private key’s passphrase, then print the plaintext to stdout. Redirect if you want a file back:

gpg --decrypt secret.txt.gpg > secret.txt

5. Once you trust the encrypted copy, shred the original

shred -u secret.txt

Otherwise the plaintext is still sitting on disk regardless of how locked the .gpg copy is.

If you want a different person to be the only one who can decode it

Get their public key (gpg --import theirkey.asc or fetch from a keyserver), then encrypt with --recipient their@email.com instead of your own. Only their private key can open it.