How to Set Up OpenPGP Encryption Keys in Thunderbird

This guide walks you through setting up OpenPGP end-to-end encryption keys in Mozilla Thunderbird so you can send and receive private, signed email from your Noiz mailbox. You will generate your own personal key pair, decide how it expires and how it is protected, make a safe backup of the sensitive half, share the public half so people can write to you securely, and import the public keys of the people you correspond with. OpenPGP (sometimes written PGP, and closely related to the GnuPG or GPG tools) has been built directly into Thunderbird since version 78, so there is no Enigmail add-on to install any more. This article is for anyone running a Noiz email account in Thunderbird who wants genuine end-to-end privacy, and it is the foundation for actually sending encrypted mail: once your keys are in place, encrypting a message is a click away.

Last reviewed: 27 July 2026, against Thunderbird 140 (latest stable, covering both the monthly Release and ESR channels). This guide is written for Noiz hosting and is kept current against Thunderbird; wording and the exact position of a button can vary slightly between versions. It complements, and does not replace, the official Thunderbird documentation linked below.

Official Documentation Reference

• OpenPGP in Thunderbird: HOWTO and FAQ (Mozilla Support): the authoritative reference for every OpenPGP feature in Thunderbird, including key generation, backup, acceptance levels, and common questions.
• Introduction to end-to-end encryption (Mozilla Support): a plain-language explanation of what end-to-end encryption is and how public and secret keys work together.
• keys.openpgp.org: about the verifying keyserver: how the modern, privacy-respecting keyserver verifies an email address before it will serve a public key.
• OpenPGP.org: the home of the open standard that Thunderbird, GnuPG, and other tools all implement, so keys are interoperable between them.

Prerequisites

• Thunderbird 78 or later (the guidance here is written for the current 140 series). The built-in OpenPGP feature is present in every recent version; older releases needed the separate Enigmail add-on, which is now retired.
• Your Noiz email account already added to Thunderbird. If you have not done this yet, follow How to Add an Email Account in Mozilla Thunderbird first, then come back here.
• A few minutes of uninterrupted time, and somewhere safe and offline (an encrypted USB stick or a password manager's secure file store) to keep your key backup.

How OpenPGP Fits With Your Noiz Mailbox

The most important thing to understand before you start is that OpenPGP is end-to-end. Your message is encrypted on your own computer, inside Thunderbird, before it ever reaches a mail server, and it is only decrypted on the recipient's computer. Nothing in the middle can read it, including the mail servers that carry it.

The practical upshot for Noiz customers is reassuring: you do not need to change anything about your mailbox to use OpenPGP. Your normal account settings, incoming IMAP on mail.yourdomain.com port 993 over SSL/TLS and outgoing SMTP on mail.yourdomain.com port 465 over SSL/TLS, carry an OpenPGP-encrypted message exactly as they carry any other. (Replace yourdomain.com with your own domain.) There is no server-side setting to switch on, no certificate to buy from Noiz, and no special mailbox type. OpenPGP is entirely a matter of the keys you set up in Thunderbird, which is what the rest of this guide covers.

It is worth being clear about what the two layers protect. The SSL/TLS on your Noiz connection protects the link between Thunderbird and the mail server (encryption in transit). OpenPGP protects the contents of the message itself, all the way to the person you are writing to (encryption end-to-end). They work together and neither replaces the other.

Understanding Your Key Pair

OpenPGP works with a matched pair of keys that are generated together and belong to you:

• Your public key is meant to be handed out freely. People use it to encrypt mail so that only you can read it, and to check that a message really came from you. Think of it as an open padlock you give to anyone: they can snap it shut around a message, but they cannot reopen it.
• Your secret key (also called the private key) never leaves your control. It is the only thing that can decrypt mail sent to you and the only thing that can sign mail as genuinely yours. If someone else gets a copy of your secret key, they can read your encrypted mail and impersonate you, which is why protecting and backing it up carefully, covered below, matters so much.

You generate this pair once per email address. After that, setup is mostly about looking after your own secret key and exchanging public keys with the people you write to.

Generate Your Personal Key Pair

Open the End-To-End Encryption settings

1. Open Account Settings (the menu button ≡ at the top right, then Account Settings; or right-click your account in the folder list and choose Settings).
2. In the left-hand list, under your Noiz account, select End-To-End Encryption.
3. In the OpenPGP section, click Add Key.
4. Choose Create a new OpenPGP Key and click Continue. (The other option, importing an existing key, is for people who already have a key from GnuPG or another mail program.)

Choose an expiry period

Thunderbird asks how long the key should stay valid. A key with an expiry date is generally the safer choice: if you ever lose access to it, it will eventually stop being used by others rather than lingering forever. A period of two to three years is a sensible default for most people, and you can always extend the date later before it lapses. Choosing Key does not expire is only worth it if you are confident you will manage the key for the long term. Whatever you pick is not permanent; expiry can be changed after the fact from the Key Manager.

Pick the key type (optional Advanced settings)

The defaults are fine for almost everyone, so you can simply move on. If you expand the Advanced section, you can choose between two key types:

• ECC (Elliptic Curve): a modern, fast key type that produces short keys with strong security. A good default on current hardware.
• RSA: the long-established type, offered at 3072 or 4096 bits. Choose RSA if you need to interoperate with older tools or a correspondent specifically asks for it. Larger RSA sizes are slower but no more compatible.

If in doubt, accept whatever Thunderbird has pre-selected. Both types are part of the OpenPGP standard and are understood by GnuPG and other mail clients.

Generate

1. Click Generate key and confirm when prompted.
2. Generation can take from a few seconds to a minute or two. It is normal for it to pause while it gathers randomness; there is nothing to do but wait.
3. When it finishes, your new key appears listed under End-To-End Encryption, selected as the personal key for this account. Thunderbird is now ready to sign and, once you have a recipient's public key, encrypt.

Protect Your Secret Key at Rest

This is the single most important gotcha in Thunderbird's OpenPGP feature, and it surprises people who have used GnuPG before. Thunderbird does not put a passphrase on the secret key itself when it creates it. Instead, your secret key is stored inside Thunderbird's own profile on your computer. If you set nothing else, anyone who can open Thunderbird on your unlocked machine can use your key.

The proper way to protect it is to set a Primary Password in Thunderbird, which encrypts the stored key material (and your saved mailbox passwords) so it cannot be used without that one password:

1. Open Settings from the menu button ≡.
2. Go to Privacy & Security.
3. Under Passwords, tick Use a Primary Password and set a strong one you will remember.

Thunderbird will then ask for this password once per session before it will unlock your secret key. Combined with your device's own login and disk encryption, this keeps your key safe at rest. The separate password you are asked to invent in the next step protects the backup file, and is a different thing from the Primary Password.

Back Up Your Secret Key

If your computer fails, is lost, or Thunderbird's profile is wiped, an unbacked-up secret key is gone for good, and with it the ability to read every message anyone ever encrypted to you. Make a backup straight away, while everything is working.

1. Open the OpenPGP Key Manager: from End-To-End Encryption click OpenPGP Key Manager, or use the Tools menu.
2. Select your own key in the list.
3. From the File menu (or the key's right-click menu), choose Backup Secret Key(s) To File.
4. Thunderbird asks you to set a password to protect the backup file. Choose a strong, unique one. This password is what stands between anyone who finds the file and your secret key, so do not skip it and do not reuse a weak password here.
5. Save the resulting .asc file somewhere genuinely safe and separate from your everyday computer: an encrypted USB stick kept offline, or the secure file vault of a reputable password manager. Do not email it to yourself or leave it in a synced Downloads folder.

Store the backup file's password somewhere you will still have it in a year, ideally in your password manager. A backup you cannot unlock is no backup at all.

Share Your Public Key

People can only send you encrypted mail once they have your public key. Sharing it is safe and encouraged; it is the public half by design. Thunderbird gives you several ways to hand it out, all from the same place.

Attach it to your signed messages

The easiest habit is to let Thunderbird include your public key on the messages you send. When you digitally sign a message, you can attach your public key to it, so anyone you write to receives it automatically and can reply securely. This is the least-effort way to spread your key to the people who actually correspond with you.

Export or copy it on demand

In the OpenPGP Key Manager, right-click your key to:

• Send Public Keys by Email: opens a new message with your public key attached, ready to send to a specific person.
• Copy Public Keys to Clipboard: pastes the key as a block of text you can drop into a chat, a website, or an email signature.
• Export Public Keys to File: saves a .asc file you can hand over however you like.

Publish it to a keyserver

To let people who do not yet know you find your key, you can upload the public key to a public directory. The modern, privacy-respecting choice is keys.openpgp.org, which verifies that you control the email address (by sending you a confirmation link) before it will serve your key to others. Export your public key as above, upload it on that site, and confirm the verification email. From then on, correspondents can look you up by your address.

Import Someone Else's Public Key

To encrypt a message to someone, you need their public key first. There are three common ways it reaches you.

From an email attachment

If a contact sends you their key, it usually arrives as a small .asc file attached to a message. Right-click the attachment and choose the option to import an OpenPGP key, or use the prompt Thunderbird shows when it recognises a key. It will preview the key details and ask you to confirm the import.

From a file you were given

In the OpenPGP Key Manager, open the File menu and choose Import Public Key(s) From File, then select the .asc or .pgp file.

By searching online

Thunderbird can look a contact up on keyservers such as keys.openpgp.org and, where the recipient's mail provider supports it, via Web Key Directory. When you start writing to someone whose key you do not have, Thunderbird offers to discover it for you.

Accept or verify the key before you trust it

This step is easy to miss and it matters. After importing a key, Thunderbird will not use it until you set its acceptance level. Open the key in the Key Manager and choose Set Acceptance:

• Accepted (unverified) lets you start encrypting to the person straight away. It is fine for low-stakes correspondence, but you have not actually proven the key belongs to them.
• Verified is the stronger option and the one to use when it matters. Compare the key's fingerprint with the owner through a separate channel you trust (read it out over a phone call, or check it in person). If the fingerprints match, mark the key verified. This is what defeats an impostor who tries to slip you a key that is not really theirs.

Until a recipient's key is at least accepted, Thunderbird cannot encrypt to them and will tell you so when you try.

Troubleshooting

• The Encrypt option is greyed out when composing: you do not yet have an accepted public key for every recipient, or you have not selected a personal key for the sending account. Import and accept the missing recipient's key, and confirm your own key is listed under Account Settings > End-To-End Encryption.
• Thunderbird keeps asking to unlock, or reports it cannot access your secret key: this is the Primary Password doing its job. Enter it when prompted. If you have genuinely forgotten it, the stored key cannot be recovered, which is exactly why the offline backup above exists.
• A contact says your messages are not encrypted, only signed: signing proves who sent a message but does not hide its contents; encryption needs their public key on your side. Make sure you have imported and accepted it, and that Encrypt (not just Digital Signature) is switched on for that message.
• An imported key will not let you encrypt: its acceptance is probably still unset. Open it in the Key Manager and choose Set Acceptance.
• You reinstalled Thunderbird or moved computers and your old encrypted mail is unreadable: restore your secret key from the backup file (Key Manager > File > Import Secret Key(s) From File) and enter the backup password you set. Without that file and password, previously encrypted mail cannot be recovered.

Setting up OpenPGP keys is a one-time job that pays off every time you need a genuinely private conversation. If you would like a hand getting your Noiz account added to Thunderbird before you start, or you run into trouble along the way, open a support ticket with the Noiz support team and describe what you are trying to do. Do note that the secret key and its passwords live only on your own device by design, so keep that backup safe: not even Noiz can recover a lost OpenPGP secret key for you.