{"slug": "gnupg", "name": "GnuPG", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 10, "warners": 5, "score": -1.09, "rising": 0.35, "first": "2025-11-13", "latest": "2026-10-21", "why": "I use GnuPG daily and mandate that everyone in our organization do the same.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 5}, "spark": [0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "I use GnuPG daily and mandate that everyone in our organization do the same.", "icon": true, "domain": null, "github_repo": null, "official_url": "https://gnupg.org", "pricing": "", "aliases": ["GnuPG"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 801887569, "item_id": 50117973, "url": "https://news.ycombinator.com/item?id=50117973", "by": "forgotmypw17", "date": "2026-10-16", "stance": "recommend", "quote": "verifies signatures with GnuPG, which means there's no password hash in the database to leak", "excerpt": "Agree, we use OpenPGP.js in our web projects. It's great for combining it with server-side GnuPG. It used to be more of a concern without TLS, but now it's reasonably secure to use. We use it for the user sessions, allowing the client to own their session and identity. The browser generates the keypair and signs each post and login challenge, so the private key never leaves the client. The server only stores the publ", "context": "builds web projects", "use_case": "server-side signature verification", "switched_from": "", "story": "Why I Wrote PGP (1991, revised 1999)"}, {"id": 776086256, "item_id": 48505391, "url": "https://news.ycombinator.com/item?id=48505391", "by": "zikduruqe", "date": "2026-06-12", "stance": "recommend", "quote": "I use GnuPG daily and mandate that everyone in our organization do the same.", "excerpt": "I use GnuPG daily and mandate that everyone in our organization do the same. As part of the onboarding process, I have a doc explaining how to install GnuPG, generate keys and how to share their public key in a specific place in our network. Once you force people to do it, it is not terrible once they get the hang of it.", "context": "runs onboarding for an organization", "use_case": "email encryption", "switched_from": "", "story": "The Future of Email"}, {"id": 742482512, "item_id": 46405157, "url": "https://news.ycombinator.com/item?id=46405157", "by": "wkat4242", "date": "2025-12-27", "stance": "recommend", "quote": "I still use it a lot especially with the private keys on openpgp smartcards or yubikeys.", "excerpt": "I don't mind gpg. I still use it a lot especially with the private keys on openpgp smartcards or yubikeys. It's a pretty great ecosystem, most hardware smartcards are surrounded by a lot of black magic and secret handshakes and stuff like pkcs#11 and opensc/openct are much much harder to configure. I use it for many things but not for email. Encrypted backups, password manager, ssh keys. For some there are other hard", "context": "", "use_case": "encrypted backups, password manager, ssh keys", "switched_from": "", "story": "Gpg.fail"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 802846289, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "warn", "quote": "I have found handling them to be a pain.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets, signing commits", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 766540528, "item_id": 47908783, "url": "https://news.ycombinator.com/item?id=47908783", "by": "Hendrikto", "date": "2026-04-26", "stance": "warn", "quote": "I feel a bit uneasy about entrusting my security to that mess.", "excerpt": "GPG seems\u2026 weird? https://floss.social/@hko/116459621169318785 > While GnuPG 2.5.x implements hybrid PQC encryption based on ML-KEM, [\u2026] GnuPG's implementation is entirely incompatible with the IETF-specified format, which all other libraries are implementing. > Both serialization and the KEM combiners differ. > The bottom line is that anyone who wants to use vendor-agnostic PQC with OpenPGP should avoid GnuPG's PQC ", "context": "", "use_case": "encryption", "switched_from": "", "story": "GnuPG \u2013 post-quantum crypto landing in mainline"}, {"id": 743800001, "item_id": 46487500, "url": "https://news.ycombinator.com/item?id=46487500", "by": "zimmerfrei", "date": "2026-01-04", "stance": "warn", "quote": "this post mainly covers a gpg problem not a PGP problem.", "excerpt": "As mentioned a few days ago, this post mainly covers a gpg problem not a PGP problem. I recommend people to spend some time and try out sequoia (sq) [0][1], which is a sane, clean room re-implementation of OpenPGP in Rust. For crypto, it uses the backend you prefer (including openssl, no more ligcrypt!) and it isn't just a CLI application but also as a library you can invoke from many other languages. It does signing", "context": "", "use_case": "", "switched_from": "", "story": "The PGP Problem (2019)"}, {"id": 737132416, "item_id": 46070776, "url": "https://news.ycombinator.com/item?id=46070776", "by": "joecool1029", "date": "2025-11-27", "stance": "warn", "quote": "gnupg2 is one of the worst user-hostile pieces of CLI software", "excerpt": "Even reading this post stresses me out. Every year or couple years I'd do it because gnupg2 is one of the worst user-hostile pieces of CLI software and I use it with smartcards (and now yubikeys). Now apparently there are alternatives, allegedly sequoia supports openpgp smartcards so I might give it a shot soon: https://gitlab.com/sequoia-pgp/sequoia-keystore/", "context": "", "use_case": "smartcard/YubiKey key management", "switched_from": "", "story": "Renewing GPG Subkeys in 2025"}]}], "who": [{"by": "forgotmypw17", "context": "builds web projects", "url": "https://news.ycombinator.com/item?id=50117973", "date": "2026-10-16"}, {"by": "zikduruqe", "context": "runs onboarding for an organization", "url": "https://news.ycombinator.com/item?id=48505391", "date": "2026-06-12"}], "tags": [], "use_cases": ["encrypting secrets, signing commits", "server-side signature verification", "email encryption", "encryption", "protecting production secrets", "encrypted backups, password manager, ssh keys"], "compared": [{"slug": "age", "name": "age", "co": 4, "switched_from": 0, "switched_to": 2}, {"slug": "sequoia", "name": "Sequoia", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pass", "name": "pass", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50175882", "title": "Setting Up SSH Keys on macOS with Touch ID", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50084674", "title": "Why I Wrote PGP (1991, revised 1999)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48502321", "title": "The Future of Email", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47907018", "title": "GnuPG \u2013 post-quantum crypto landing in mainline", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47133055", "title": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46486326", "title": "The PGP Problem (2019)", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 2, "neutral": 1}, "2025-12": {"recommend": 1}, "2026-01": {"warn": 1}, "2026-02": {"neutral": 1}, "2026-03": {}, "2026-04": {"warn": 1}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 1, "warn": 1}}, "quotes": [{"id": 802846289, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "warn", "quote": "I have found handling them to be a pain.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets, signing commits", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 801887569, "item_id": 50117973, "url": "https://news.ycombinator.com/item?id=50117973", "by": "forgotmypw17", "date": "2026-10-16", "stance": "recommend", "quote": "verifies signatures with GnuPG, which means there's no password hash in the database to leak", "excerpt": "Agree, we use OpenPGP.js in our web projects. It's great for combining it with server-side GnuPG. It used to be more of a concern without TLS, but now it's reasonably secure to use. We use it for the user sessions, allowing the client to own their session and identity. The browser generates the keypair and signs each post and login challenge, so the private key never leaves the client. The server only stores the publ", "context": "builds web projects", "use_case": "server-side signature verification", "switched_from": "", "story": "Why I Wrote PGP (1991, revised 1999)"}, {"id": 776086256, "item_id": 48505391, "url": "https://news.ycombinator.com/item?id=48505391", "by": "zikduruqe", "date": "2026-06-12", "stance": "recommend", "quote": "I use GnuPG daily and mandate that everyone in our organization do the same.", "excerpt": "I use GnuPG daily and mandate that everyone in our organization do the same. As part of the onboarding process, I have a doc explaining how to install GnuPG, generate keys and how to share their public key in a specific place in our network. Once you force people to do it, it is not terrible once they get the hang of it.", "context": "runs onboarding for an organization", "use_case": "email encryption", "switched_from": "", "story": "The Future of Email"}, {"id": 766540528, "item_id": 47908783, "url": "https://news.ycombinator.com/item?id=47908783", "by": "Hendrikto", "date": "2026-04-26", "stance": "warn", "quote": "I feel a bit uneasy about entrusting my security to that mess.", "excerpt": "GPG seems\u2026 weird? https://floss.social/@hko/116459621169318785 > While GnuPG 2.5.x implements hybrid PQC encryption based on ML-KEM, [\u2026] GnuPG's implementation is entirely incompatible with the IETF-specified format, which all other libraries are implementing. > Both serialization and the KEM combiners differ. > The bottom line is that anyone who wants to use vendor-agnostic PQC with OpenPGP should avoid GnuPG's PQC ", "context": "", "use_case": "encryption", "switched_from": "", "story": "GnuPG \u2013 post-quantum crypto landing in mainline"}, {"id": 754143600, "item_id": 47133975, "url": "https://news.ycombinator.com/item?id=47133975", "by": "stephenr", "date": "2026-02-23", "stance": "neutral", "quote": "We use GPG'd files that are ingested during environment setup", "excerpt": "> can read files in your project directory, which means a plaintext .env file is an accidental secret dump waiting to happen It's almost like having a plaintext file full of production secrets on your workstation is a bad fucking idea. So this is apparently the natural evolution of having spicy autocomplete become such a common crutch for some developers: existing bad decisions they were ignoring cause even bigger pr", "context": "", "use_case": "protecting production secrets", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 743800001, "item_id": 46487500, "url": "https://news.ycombinator.com/item?id=46487500", "by": "zimmerfrei", "date": "2026-01-04", "stance": "warn", "quote": "this post mainly covers a gpg problem not a PGP problem.", "excerpt": "As mentioned a few days ago, this post mainly covers a gpg problem not a PGP problem. I recommend people to spend some time and try out sequoia (sq) [0][1], which is a sane, clean room re-implementation of OpenPGP in Rust. For crypto, it uses the backend you prefer (including openssl, no more ligcrypt!) and it isn't just a CLI application but also as a library you can invoke from many other languages. It does signing", "context": "", "use_case": "", "switched_from": "", "story": "The PGP Problem (2019)"}, {"id": 742482512, "item_id": 46405157, "url": "https://news.ycombinator.com/item?id=46405157", "by": "wkat4242", "date": "2025-12-27", "stance": "recommend", "quote": "I still use it a lot especially with the private keys on openpgp smartcards or yubikeys.", "excerpt": "I don't mind gpg. I still use it a lot especially with the private keys on openpgp smartcards or yubikeys. It's a pretty great ecosystem, most hardware smartcards are surrounded by a lot of black magic and secret handshakes and stuff like pkcs#11 and opensc/openct are much much harder to configure. I use it for many things but not for email. Encrypted backups, password manager, ssh keys. For some there are other hard", "context": "", "use_case": "encrypted backups, password manager, ssh keys", "switched_from": "", "story": "Gpg.fail"}, {"id": 737242674, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "neutral", "quote": "Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey.", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "encrypting secrets", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}, {"id": 737132416, "item_id": 46070776, "url": "https://news.ycombinator.com/item?id=46070776", "by": "joecool1029", "date": "2025-11-27", "stance": "warn", "quote": "gnupg2 is one of the worst user-hostile pieces of CLI software", "excerpt": "Even reading this post stresses me out. Every year or couple years I'd do it because gnupg2 is one of the worst user-hostile pieces of CLI software and I use it with smartcards (and now yubikeys). Now apparently there are alternatives, allegedly sequoia supports openpgp smartcards so I might give it a shot soon: https://gitlab.com/sequoia-pgp/sequoia-keystore/", "context": "", "use_case": "smartcard/YubiKey key management", "switched_from": "", "story": "Renewing GPG Subkeys in 2025"}, {"id": 734643440, "item_id": 45915215, "url": "https://news.ycombinator.com/item?id=45915215", "by": "lrvick", "date": "2025-11-13", "stance": "warn", "quote": "Ignore GnuPG which is a shit show stuck in the 90s.", "excerpt": "Age only covers encryption. It does not cover signing, ssh, web of trust, hierarchical keys, key discovery, etc. It is in no way a replacement for a modern PGP keychain. Ignore GnuPG which is a shit show stuck in the 90s. PGP != GPG For a modern long lived personal PGP keychain use Keyfork on AirgapOS which gives you a secure 24 word mnemonic backup, optional split backup across redundant smartcards, and a separation", "context": "", "use_case": "", "switched_from": "", "story": "Switching from GPG to Age"}]}