OpenPGP email encryption: why we ask clients to use it
Ordinary email is protected while it travels but sits readable on every mail server it passes through and in every mailbox it lands in. OpenPGP end-to-end encryption changes that: the message is scrambled on your computer and only the people you sent it to can unscramble it. Noiz asks clients to use it for the conversations that matter, such as contracts, identity documents and financial or health details, because it keeps those messages safe even if a password is stolen or a mailbox is broken into, wherever the mail is hosted.
This is the first of three short articles. The second covers creating your first OpenPGP key and the third swapping keys with the people you write to.
In short
- Transport encryption (TLS) protects email on each hop, but a message sits readable on every server and in every mailbox once it arrives.
- OpenPGP encrypts the message on your computer, so only the recipient's secret key can read it. It does not hide who wrote to whom, or when.
- Encrypt contracts, identity documents and bank details. Sign everyday mail. Never email passwords.
- Lose your secret key and the mail is gone, so back it up, and check each correspondent's key before you trust it.
What protects email today, and where does it stop?
Two layers of protection apply to almost every email.
| Layer | What it does | Where it stops |
|---|---|---|
| Transport encryption (TLS) | Protects a message on each network hop, between your mail app and your provider, and between mail servers, so someone on the network cannot read it in passing | The message sits readable on every server and in every mailbox once it arrives |
| Domain authentication (SPF, DKIM and DMARC) | Lets receiving servers check that mail claiming to come from your domain really does; our guide How to protect your domain from spoofing explains them | It says who sent the message, not who can read it |
Mozilla, the maker of Thunderbird, puts it plainly in its introduction to end-to-end encryption:
"Without this protection it is easy for network administrators, email providers and government agencies to read your messages."
The bigger risk is anyone who gets into a mailbox. A stolen password, a hacked server or a mistaken forward exposes everything stored there.
What does OpenPGP end-to-end encryption add?
The message is locked before it leaves your computer. With OpenPGP, you encrypt a message to the recipient's public key. Only the matching secret key, which stays on the recipient's devices, can decrypt it. Every copy on every server, including the one in your own Sent folder, is scrambled text.
| OpenPGP protects | OpenPGP does not protect |
|---|---|
| The message body and attachments | Who wrote to whom, and when |
| Every copy on every server and in every mailbox | The subject line, unless your mail app encrypts it (Thunderbird can) |
| Proof of who sent it, when the message is signed | A message once it is decrypted on a device, or forwarded without encryption |
Signing is the other half. A signed message proves it came from the holder of the key and was not changed on the way, and you can sign mail to anyone, even people who do not use OpenPGP yet.
Why do we recommend OpenPGP?
- It is an open standard. OpenPGP is defined by the Internet Engineering Task Force; the current version, RFC 9580, was published in July 2024. Any compliant app can read mail from any other.
- The tools are free and open source. Thunderbird has had OpenPGP built in since version 78 in 2020. Thunderbird for Android works with the free OpenKeychain app. Mailvelope adds it to webmail in the browser.
- It does not depend on any provider. With end-to-end encryption you do not have to rely on a promise from your mail provider, from us or from anyone else, for your most sensitive messages.
- It protects against the commonest attacks. Most mailbox break-ins start with a stolen password or a stolen signed-in session, as our article Infostealer malware: how to protect your business passwords explains. An encrypted message stays unreadable to whoever gets in, as long as your secret key is not on the device they control.
What should you encrypt?
You do not need to encrypt everything. A sensible rule:
| Do this | With |
|---|---|
| Encrypt | Contracts, quotes and invoices with bank details, copies of identity documents, payslips and tax documents, medical or legal matters, and anything you would not want read aloud |
| Sign | Everyday business mail, so people learn to expect your signature and notice when it is missing |
| Never email | Passwords, encrypted or not |
Encryption only works when both sides take part, so start with the few people you exchange sensitive mail with most often.
What are the limits of OpenPGP?
- Lose your secret key and the mail is gone. Mozilla is explicit that encrypted messages cannot be recovered by anyone without it. Part 2 covers backing it up.
- Encrypted mail cannot be searched or spam-scanned on the server, because the server cannot read it.
- A key can be made in anyone's name, so you need to check that a key belongs to the person. Part 3 covers how.
How do you start with OpenPGP?
The steps are in our help articles, which are kept up to date as the apps change:
- Why and how to switch to Thunderbird
- Why and how to encrypt your email with OpenPGP
- How to set up OpenPGP encryption keys in Thunderbird
- How to send encrypted and signed email with OpenPGP in Thunderbird
- On a phone: How to use OpenPGP encryption on Android with Thunderbird. In webmail: How to encrypt webmail with Mailvelope and OpenPGP.
OpenPGP works with any mailbox that supports IMAP, including the email on every Noiz hosting plan.
Read next:
- Your first OpenPGP key: create it, back it up, lock it, part 2 of this series.
- Why email encryption matters more in the age of AI, on why the case for encrypting has grown.
- Keeping your own copy of your email: archives and mailbox backups, on keeping mail you can still read.
If you would like help setting up OpenPGP for your team, get in touch.
Sources
- RFC 9580, OpenPGP (July 2024): https://www.rfc-editor.org/rfc/rfc9580.html
- Mozilla Support, introduction to end-to-end encryption in Thunderbird: https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption
- Mozilla Support, OpenPGP in Thunderbird, how-to and FAQ: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq
- Mozilla Support, OpenPGP in Thunderbird for Android: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-android-howto
- Mailvelope FAQ: https://mailvelope.com/en/faq
- NIST SP 800-177 Rev. 1, Trustworthy Email (February 2019): https://csrc.nist.gov/pubs/sp/800/177/r1/final
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
