OpenPGP public key: how to swap keys and check them
To send someone an encrypted email you need their OpenPGP public key, and they need yours. Keys can be found automatically through the keys.openpgp.org keyserver, published on a domain's own website, or carried in the headers of ordinary email. The step that makes it safe is checking the key's fingerprint with the person, by phone, video or in person, because anyone can create a key in anyone else's name.
This is the last of three articles, after why we ask clients to encrypt sensitive email and your first OpenPGP key.
In short
- Sharing your public key is safe. Upload it to keys.openpgp.org, or let Thunderbird attach it to signed mail.
- Thunderbird's Discover Keys Online finds other people's keys through keys.openpgp.org and Web Key Directory.
- Always check a new key's fingerprint with its owner by phone, video or in person before you accept it.
- If a correspondent's key suddenly changes, check the new fingerprint the same way.
How do you share your own OpenPGP public key?
The easiest way to start is to make your public key easy to find.
- Upload it to keys.openpgp.org. This community-run keyserver publishes the email address on a key only after the owner confirms it from that mailbox, and lets you remove it again. People can search only by exact email address, so the server cannot be used to harvest addresses. Thunderbird searches it when you look for a key.
- Attach it to signed mail. Thunderbird attaches your public key to signed messages by default, so anyone you write to receives it. Newer versions let you turn this off in the account settings.
- Send the file. Your public key is a small file that is safe to give to anyone.
How do you find other people's keys?
Thunderbird can search for a correspondent's key by email address. In the OpenPGP Key Manager, the Keyserver menu has a Discover Keys Online command, and it searches the first two sources below. The third needs no search:
| Source | How it works | Good to know |
|---|---|---|
| keys.openpgp.org | A community-run keyserver; people search by exact email address | Lists a key's address only if the owner confirmed it |
| Web Key Directory (WKD) | An organisation publishes its staff's public keys on its own website, at a standard address that mail apps know to check | Described in an Internet draft rather than a finished standard, and many organisations use it |
| Autocrypt | Your public key travels in a header of ordinary email, so a correspondent's app can learn it without any lookup | Its own specification says it defends only against passive collection of mail, not against someone deliberately impersonating a correspondent |
Keys also arrive by themselves. Thunderbird's Autocrypt support is limited: it adds the header when you attach your key, and offers to import a key that arrives in one, but it does not encrypt automatically.
How do you check that an OpenPGP key is really theirs?
A key is only as good as your confidence about who holds it. Mozilla's FAQ puts the risk in one sentence:
"Technically, anyone is able to create an OpenPGP key in anyone's name, using any email address they want."
Accepting a key without checking it leaves you open to someone placing themselves between you and your correspondent. The check is quick:
- Open the key in Thunderbird's key manager and find its fingerprint, a long string of letters and numbers unique to that key.
- Ask the person to read out their fingerprint over a channel where you recognise them: a phone call, a video call or in person.
- If the two match, accept the key and mark it as verified in Thunderbird.
Thunderbird shows signatures from keys you have accepted as valid, and treats others with caution. Do the check once per person; you do not need to repeat it unless their key changes.
What should you do when a key changes?
Check the new fingerprint before you trust it. People replace keys when they get a new computer without a backup, or when a key expires. If a correspondent's key suddenly changes, check the new fingerprint with them the same way. An unexpected new key is exactly what an impersonator would send.
How do you put it into practice?
- Publish your key. Upload your key to keys.openpgp.org and confirm your address.
- Sign everyday mail, so your key travels with it.
- Swap with a few people. Pick the two or three people you exchange sensitive mail with, swap keys, and check fingerprints on your next call.
- Encrypt the next one. Encrypt the next contract, ID copy or bank detail you send them.
The step-by-step guide is How to send encrypted and signed email with OpenPGP in Thunderbird.
Read next:
- Your first OpenPGP key: create it, back it up, lock it, part 2 of this series.
- Why we ask clients to encrypt sensitive email with OpenPGP, part 1 of this series.
- Why email encryption matters more in the age of AI, on why the case for encrypting has grown.
If your organisation would like help with OpenPGP for its staff, get in touch.
Sources
- keys.openpgp.org, about: https://keys.openpgp.org/about
- keys.openpgp.org, privacy policy: https://keys.openpgp.org/about/privacy
- keys.openpgp.org, usage: https://keys.openpgp.org/about/usage
- Web Key Directory, IETF draft (draft-koch-openpgp-webkey-service): https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/
- Autocrypt Level 1 specification: https://docs.autocrypt.org/level1.html
- Mozilla Support, OpenPGP in Thunderbird, how-to and FAQ: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq
- Mozilla Support, introduction to end-to-end encryption in Thunderbird: https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption
- RFC 9580, OpenPGP: https://www.rfc-editor.org/rfc/rfc9580.html
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
