Frequently Asked Questions (FAQ)

Questions are grouped by topic. Click any question to open its answer.

Getting Started

How do I get GpgFrontend?

You can download the latest version of GpgFrontend from GpgFrontend’s Downloads Page and pick the install method for your platform.

Which operating systems does GpgFrontend support?

GpgFrontend runs on Windows, macOS, and Linux, so almost anyone can use it to protect their privacy and data.

How do I update GpgFrontend to the latest version?

You can always get the latest stable or nightly release from the Downloads Page. On Windows, just run the new installer. On macOS and Linux, replace the old app or AppImage with the new version. Your settings and keys are kept unless the release notes say otherwise.

Note that the built-in update check only offers newer releases from your own series (for example, 2.2.x). Moving to a new series is a step you take yourself; see the Version Numbering Policy.

OpenPGP and the Engines

How do OpenPGP, PGP, and GnuPG (GPG) relate?

OpenPGP is the open standard (RFC 4880) for encrypted email, files, and digital signatures.
PGP was the original closed-source software from the 1990s. It is rarely used today, but the name is sometimes used loosely to mean the OpenPGP standard.
GnuPG (GPG) is the most widely used free, open-source version of the OpenPGP standard.

Today, when people say “PGP encryption,” they almost always mean the OpenPGP standard, and the tool they actually use is GnuPG (GPG) or another compatible app. GpgFrontend is an easy-to-use front-end for OpenPGP. It uses GnuPG as its main engine and, since v2.2.0, also offers an optional rPGP engine, making OpenPGP encryption easy for everyone.

Which engines does GpgFrontend use?

GpgFrontend supports more than one engine.

In the regular GpgFrontend desktop edition, GnuPG is the default and main backend. It offers proven, widely used OpenPGP features and is best for users who need full compatibility with existing GnuPG setups.

GpgFrontend also offers an rPGP backend for certain uses. The rPGP engine is written in Rust and supports newer OpenPGP features, including OpenPGP v6 / RFC 9580.

What is the rPGP engine?

The rPGP engine is another OpenPGP backend that GpgFrontend uses for certain tasks. It is written in Rust and lets GpgFrontend offer a complete OpenPGP experience without needing a separate GnuPG install.

Does rPGP replace GnuPG in GpgFrontend?

No. In the regular GpgFrontend desktop edition, GnuPG is still the default and main backend.

The rPGP engine is an extra backend for certain uses, such as sandbox-friendly operation and newer OpenPGP features. Some advanced features available through GnuPG may not work through rPGP yet.

Can I use the same keys with GnuPG and rPGP?

Not always. GnuPG and rPGP store keys separately in GpgFrontend, and some key types, packet formats, or newer OpenPGP features may not be fully compatible between the two engines.

If you need full compatibility with existing GnuPG setups, use the regular GpgFrontend desktop edition with the GnuPG backend.

GpgFrontend Lite (Mac App Store)

Is GpgFrontend available on the Mac App Store?

Yes. GpgFrontend Lite is on the Mac App Store as a lightweight, sandbox-friendly edition for macOS.

The regular GpgFrontend desktop edition is not on the Mac App Store. The regular edition works with GnuPG and offers advanced settings that don’t fit the macOS App Sandbox model the Mac App Store requires.

GpgFrontend Lite is fully self-contained, uses the rPGP engine, and does not include GnuPG. If you need the full GnuPG-based desktop experience, install the regular GpgFrontend edition from GitHub, Homebrew, or other package channels.

Why is there a separate GpgFrontend Lite edition?

GpgFrontend Lite is not a replacement for the regular GpgFrontend desktop edition. It is a separate Mac App Store edition made for the macOS App Sandbox.

The regular GpgFrontend desktop edition is built around the full GnuPG-based experience, including advanced settings, links to existing GnuPG setups, and access to your normal desktop environment. These features don’t fit the sandboxed model that the Mac App Store requires.

So GpgFrontend Lite uses the rPGP engine and keeps its key data inside the app-managed macOS sandbox storage. This makes it a good fit for a self-contained Mac App Store release while still handling everyday OpenPGP tasks such as encryption, decryption, signing, verification, and local key management.

Feature	Regular Desktop Edition	Lite Edition (App Store)
Engine	GnuPG (Primary) + rPGP	rPGP Only (Pure Rust)
Environment	Full System Access	macOS Sandbox (Enhanced Security)
GnuPG Integration	Yes (System GPG)	No (Self-contained)
Best For	Professional & Critical Work	Modern v6 Workflows & Quick Tasks

Where are keys stored in GpgFrontend Lite?

GpgFrontend Lite stores its key data locally inside the app-managed macOS sandbox storage. It does not upload your keys or messages to any server.

Please back up the OpenPGP keys you create or import in GpgFrontend Lite. If your keys are lost, encrypted data may not be recoverable.

Can GpgFrontend Lite use my existing GnuPG keyring?

No. GpgFrontend Lite does not include or link to GnuPG, so it cannot directly use your existing GnuPG keyring.

To use a key from another OpenPGP app, export the key from that app and import it into GpgFrontend Lite. Be careful when exporting secret keys, and keep your backups safe.

Which version should I use: GpgFrontend or GpgFrontend Lite?

Use the regular GpgFrontend desktop edition if you need the full GnuPG-based experience, advanced settings, or full compatibility with existing GnuPG setups.

Use GpgFrontend Lite if you prefer a simple, self-contained Mac App Store edition for everyday OpenPGP tasks on macOS.

Why GPG / OpenPGP

Why choose GPG/OpenPGP over other encryption tools?

Open source and audited: GPG is open-source, free, and maintained by a large community. Its code has been reviewed for decades, which builds security and trust.
No vendor lock-in: fully standards-based. Works across major platforms, email apps, and tools. Your keys and data stay portable.
Full set of features: supports symmetric/asymmetric encryption, digital signatures, key management, key revocation, and a strong web-of-trust model.
Transparency and control: every encryption step is visible and adjustable. You decide how your data is secured, with no hidden algorithms or automation.
Works together: compatible with any OpenPGP-compliant software, so your data stays easy to read and share.

Closed-source tools may limit which platforms they run on, hide how data is encrypted, or lock you into their ecosystem.

How secure is GPG?

When used correctly, GPG gives strong protection:

Strong algorithms and key sizes are available, in line with modern standards.
Open source: the code is constantly reviewed by experts around the world.
No mass leaks: no major flaw has ever led to a wide compromise of GPG private keys.
Most risks come from user mistakes, such as weak passphrases, mishandled keys, or device malware, not from GPG itself.

Bottom line: your keys and passphrase are just as important as the software you use.

Has GnuPG ever been successfully attacked?

According to the official GnuPG FAQ 11.8:

“If you mean, “has GnuPG traffic ever been successfully cryptanalyzed?”, the answer is a flat “no”. We are unaware of any credible reports of any of the ciphers used in GnuPG having ever been successfully cryptanalyzed.“

What makes GPG/OpenPGP different from instant messengers or built-in encryption?

No accounts or servers: you don’t need to register or rely on any service.
Long-term trust: keys can be used for years, supporting file, email, and software signing and “web of trust” models.
Works offline: encrypt or sign files for transfer over any medium, with no internet needed.
Manual and open: everything is under your control, with no forced automation or cloud syncing.

Instant messengers (Signal, Matrix, etc.) are great for real-time chat but need accounts, central servers, and frequent key changes, so they’re less suited to offline or anonymous use.

When is GPG/OpenPGP the best tool?

Secure file exchange with strangers: journalists, whistleblowers, or anyone who needs anonymous document transfer.
Publishing signed content: software releases, scientific results, or public statements that need long-term verification.
Air-gapped environments: moving encrypted data between computers that are never connected to the internet.
Full transparency: every encryption step is visible and can be checked.

Why not just use password-based encryption?

Public-key encryption (like GPG) is more flexible and secure:

No need to share passwords in advance; you only publish your public key.
Anyone can encrypt for you, even if you’ve never met.
Digital signatures prove who wrote a message and that it wasn’t changed.
Keys can be revoked or replaced at any time without breaking old data.

Can I use GPG with keys or data from other programs?

Yes. If your keys and encrypted data are in an OpenPGP-compatible format, GnuPG and GpgFrontend can work with them. This includes most keys and data from compliant GPG or older PGP programs.

Using GpgFrontend

What if I see “GnuPG not installed correctly”?

This message mainly applies to GpgFrontend versions before 2.2.0, or to GnuPG-specific workflows in the regular desktop edition.

Starting from GpgFrontend 2.2.0, if GnuPG is not available, GpgFrontend can switch to the built-in rPGP engine so the app can still start and offer basic OpenPGP features.

To use the regular GnuPG backend, existing GnuPG keyrings, smart cards, or other GnuPG-specific features, please install GnuPG:

macOS: Install GnuPG using Homebrew with brew install gnupg.
Linux: Install GnuPG via your package manager, for example sudo apt install gpg or sudo dnf install gnupg.
Windows: Recent regular desktop builds include GnuPG. If needed, you can also download GnuPG from the official GnuPG website.

How do I import or export keys in GpgFrontend?

Use the Key Management section to import or export public/private keys. You can also drag and drop key files directly into the app’s Key ToolBox.

Can I encrypt and decrypt files as well as text?

Yes, GpgFrontend handles both text and files. Use the file options in the main interface to protect or unlock files.

Does GpgFrontend support OpenPGP smart cards or tokens?

Yes, if your GnuPG supports smart cards. Manage your smart cards directly in the SmartCard Controller. Smart card support needs the GnuPG engine; the rPGP engine does not support smart cards or tokens.

Is GpgFrontend available in my language?

GpgFrontend supports many languages. Open Settings, choose General, and pick your language. Want to help translate? See the contribution guide on GitHub!

I cannot find a setting. Where did the tabs go?

The settings window was rebuilt in v2.2.2. The row of tabs across the top is gone, replaced by a search box and a list of pages down the left side.

Type what you are looking for into the search box. It matches page names and the settings on them, so you do not have to guess. See Finding Your Settings.

What is a profile?

A profile is one complete GpgFrontend setup: its own keys, its own settings, and its own saved state. You already have one, and one is enough for most people.

Make a second one if you want to keep work and personal keys apart, or if you want a setup you can carry to another computer. See Profiles.

Can I move my whole setup to another computer?

Yes. Open the Profiles menu and choose Export This Profile. That writes your keys, settings and saved state into a single .gfp file, protected by a passphrase you choose.

On the other computer, use Import Profile File, or just double-click the file. See Profiles.

What is IM Encrypt?

Normal encrypted text is a big block that chat apps often break. IM Encrypt turns your message into one short line that pastes cleanly into any messenger.

The other person just presses Decrypt as usual. See Instant Messaging.

Where did my favourite keys go?

The Favourite tab was replaced by key categories in v2.2.2. Categories do the same job and more: you can have as many as you like, name them, and give each one a colour.

Old favourites are not carried over, so you need to make a category and put those keys back in it. See Key Categories.

Why can I no longer generate a DSA key?

On the rPGP engine, DSA and RSA keys below 2048 bits are no longer offered for new keys. The current OpenPGP standard (RFC 9580) says they are no longer safe enough.

Existing keys of these types still import and still work. The GnuPG engine still offers both if you really need one.

What happened to the startup self-check?

It was removed in v2.2.2. GpgFrontend no longer verifies its own libraries while starting.

It is still a good idea to check that your download is genuine. The best time to do that is before you install. See Code & Binary Verify.

What are Nightly versions?

These are auto-generated test builds with new features and fixes still being tested. They are less stable than official releases, may include breaking changes, and are not GPG-signed. They are not recommended for production. Always check the SHA256 checksum. Please report feedback and issues on GitHub.

For how stable, beta and nightly builds relate, see Stable, Beta, and Nightly in the Version Numbering Policy.

Your Keys, Privacy, and Security

How does GpgFrontend handle passphrases or PINs?

This depends on the engine used by the active key database.

With the GnuPG engine, GpgFrontend never reads or stores your GPG key passphrases or smart card PINs. All PIN entry is handled safely by GnuPG’s pinentry and gpg-agent, separate from GpgFrontend.

With the rPGP engine, there is no gpg-agent or pinentry, so GpgFrontend asks for the passphrase itself and passes it to the rPGP engine. Passphrases are kept only in memory while the task runs and then cleared; they are never written to disk.

For app-specific encryption (e.g., KeyPackage), passphrases and PINs are used only in memory and cleared right away. Advanced users can turn on PIN caching and adjust security levels.

Can lost passwords or keys be recovered?

No. For your security, neither GpgFrontend nor the developer can recover lost passwords or private keys. Make sure to back up your private key and remember your passphrase!

How does GpgFrontend keep communication secure?

It uses a proven OpenPGP engine (GnuPG by default, or the rPGP engine when chosen) with strong encryption algorithms. Only the intended recipients can decrypt your messages.

What data does GpgFrontend collect?

GpgFrontend does not collect or send any personal or usage data. All encryption runs locally. Update checks can be turned off, and there is no tracking or analytics built in.

There is also no AI feature in the app, and nothing you do is ever sent to an AI service. See the AI Policy.

Community and Support

Is GpgFrontend really free? Can I donate?

Yes, it is completely free, and no, the project does not take donations. There is no paid version and no locked features. If someone asks you to pay for GpgFrontend, it is not from this project. See Free & No Donations for the full story, and for ways to help that matter more than money.

Is AI used to build GpgFrontend?

AI coding tools help write ordinary code, tests and documentation, under the direction and review of the maintainer. There is no AI in the app itself, and AI does not write the cryptography; that is done by GnuPG and rPGP. The AI Policy explains the whole arrangement.

How can I request a new feature?

You can suggest new features by opening an issue on GitHub or contacting the maintainer directly.

Found a bug?

If you run into any issues with GpgFrontend, please report them on the GitHub repository. You can also contact me directly if you’re not on GitHub; see the Contact section for details.

Interested in contributing?

Feel free to change GpgFrontend’s code and submit a Pull Request with your improvements. You can also send patches by email if you prefer to contribute anonymously. See Contributing to GpgFrontend to get started, and the AI Policy if you use AI tools in your work.