OpenPGP key: create it, back it up and lock it in Thunderbird

Encrypted email rests on one thing you must look after: your OpenPGP key pair. The public key is the half you share, so people can encrypt messages to you. The secret key is the half that decrypts them, and it never leaves your devices. Create the pair once in Thunderbird, protect it with a Primary Password, back it up somewhere other than your computer, and use the same key on every device you read mail on.

This is part 2 of a three-part series, after why we ask clients to encrypt sensitive email with OpenPGP.

Before you start

• Thunderbird on your computer. OpenPGP has been built in since version 78, so there is nothing extra to install.
• A mailbox already set up in Thunderbird, because the key belongs to one email address.
• Somewhere separate from your computer for the backup, such as an encrypted USB drive or a password manager with secure file storage.

What is an OpenPGP key pair?

A key pair is two linked files. Think of the public key as an open padlock you hand out freely: anyone can snap it shut on a box, but only your secret key opens it again.

Your public key can go anywhere. It can sit on a website, a keyserver or in every email you sign.

Your secret key must stay private, because whoever holds it can read your encrypted mail and sign messages as you.

How do you create an OpenPGP key in Thunderbird?

Thunderbird uses its own encryption library, so everything happens inside the app. In outline, from Mozilla's guide:

1. Open the account settings for your mailbox, select your account and choose End-to-End Encryption.
2. Select Add Key and choose to create a new OpenPGP key, or to import one you already have.
3. Follow the prompts. When the key exists, select it as the key to use with your mailbox.

Our help article How to set up OpenPGP encryption keys in Thunderbird goes through each screen. Menu names change between Thunderbird versions, so follow the labels on your screen if they differ.

If you already have a key from another app, import it rather than making a second one, so people can keep writing to you with the key they already have.

Why lock your key with a Primary Password?

Without one, your keys are unprotected on disk. Mozilla warns that without a Primary Password, the OpenPGP keys in your Thunderbird profile are unprotected. Anyone, or any program, that can read your profile folder could copy them.

To set it, open the Thunderbird menu, choose Settings, then Privacy & Security, and under Passwords tick Use a Primary Password. Thunderbird asks for it once per session.

Choose it carefully. Use a long password you can remember and do not use anywhere else. Mozilla notes that a forgotten Primary Password cannot be recovered, only reset, which deletes the stored credentials.

How do you back up your OpenPGP key?

Back it up away from the computer. Mozilla's guide says to back up your key and store it somewhere secure, separate from your regular computer. If you lose your computer or erase its data, you can no longer read your encrypted messages, and Mozilla's introduction is blunt about it:

"Your messages are not recoverable in any way, by anyone, if this happens."

A failed disk, a stolen laptop or a reinstalled computer would take every encrypted message with it, including the copies in your Sent folder. People could also keep sending you mail you can no longer read.

To make the backup:

1. Open Thunderbird's OpenPGP Key Manager from the Tools menu.
2. Select your key and choose Backup secret key from the File menu.
3. Protect the backup file with a strong password when asked.
4. Store it on an encrypted USB drive or in a password manager's secure file storage, and keep that copy somewhere other than the computer.

How do you use the same key on every device?

Use the same personal key everywhere you read mail. Mozilla notes that all your devices need the same key to read the same mail. Import the backup into Thunderbird on a second computer, into the free OpenKeychain app for Thunderbird for Android, or into the Mailvelope extension for webmail.

Which habits should you start with on day one?

• Sign by default. Thunderbird signs encrypted mail automatically, and you can choose to sign everyday mail too. Signing proves the message is yours.
• Let replies stay encrypted. Thunderbird encrypts replies to encrypted mail by default, so a secret is not quoted back in plain text.
• Do not forward an encrypted message without encryption. Mozilla points out that this removes the protection.
• Keep the subject plain. Thunderbird can encrypt the subject line, but the safest habit is a subject that gives nothing away.

Read next:

• Swapping OpenPGP keys, and making sure they are genuine, part 3 of this series.
• Why we ask clients to encrypt sensitive email with OpenPGP, part 1 of this series.
• Securing webmail: two-factor sign-in and encryption, on reading encrypted mail in a browser.

If your organisation would like its mailboxes on a mail server of its own, with two-factor authentication for users, ask Noiz about Private Email, which is quoted for each deployment.

Sources

• Mozilla Support, OpenPGP in Thunderbird, how-to and FAQ: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq
• Mozilla Support, introduction to end-to-end encryption in Thunderbird: https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption
• Mozilla Support, protect your Thunderbird passwords with a Primary Password: https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-primary-password
• Mozilla Support, OpenPGP in Thunderbird for Android: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-android-howto
• Mailvelope FAQ: https://mailvelope.com/en/faq
• RFC 9580, OpenPGP: https://www.rfc-editor.org/rfc/rfc9580.html

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.