How to Send Encrypted and Signed Email with OpenPGP in Thunderbird

Once you have OpenPGP keys set up in Mozilla Thunderbird, this guide shows you how to actually use them: how to send a message that is encrypted so only the intended recipient can read it, how to add a digital signature that proves a message genuinely came from you and has not been altered, and how to read encrypted and signed mail that arrives in your Noiz mailbox. It also explains, in plain language, the difference between encryption and signing (they protect different things), what you need before you can encrypt to someone, and the real-world limitations worth knowing before you rely on OpenPGP. This article is for anyone using a Noiz email account in Thunderbird who wants genuine end-to-end privacy on individual messages. OpenPGP is built directly into Thunderbird, so no add-on such as Enigmail is required.

Last reviewed: 27 July 2026, against Mozilla Thunderbird 140+ (2026 monthly Release channel, and equally applicable to the current ESR release). This guide is written for Noiz hosting and is kept current against Thunderbird. Exact button and menu labels can vary slightly between versions, so where your screen differs, check the official Thunderbird documentation linked below. This article complements, and does not replace, that documentation.

Official Documentation Reference

• Mozilla Support: OpenPGP in Thunderbird, HOWTO and FAQ, the authoritative reference for keys, encryption, signing, and troubleshooting
• Mozilla Support: Introduction to End-to-end encryption in Thunderbird, the conceptual overview of how OpenPGP protects messages
• Mozilla Support: Thunderbird Privacy and Security Settings, the topic hub for all encryption and security articles

Prerequisites

• OpenPGP keys already configured in Thunderbird, that is, your own personal key generated or imported, and the public key of anyone you want to encrypt to already imported and accepted. If you have not done this yet, follow How to Set Up OpenPGP Encryption Keys in Mozilla Thunderbird first. Everything in this guide depends on that setup.
• A working Noiz email account in Thunderbird. If your account is not yet added, see How to Add an Email Account in Mozilla Thunderbird.
• For anyone you want to send encrypted mail to: their OpenPGP public key. You cannot encrypt to a person whose public key you do not hold.

Encryption Versus Signing: What Each One Protects

OpenPGP gives you two independent protections. They are often used together, but they are not the same thing and it is worth understanding which does what, because people frequently expect one to do the job of the other.

• Encryption protects confidentiality. The message body and any attachments are scrambled so that only someone holding the matching private key can read them. You encrypt to a recipient using their public key; only their private key can unlock it. This is what stops anyone in between, including mail servers, from reading the content.
• A digital signature protects authenticity and integrity. A signature proves the message really came from you and that not a single character was changed in transit. You sign with your own private key, and recipients verify the signature using your public key. Signing does not hide the content: a signed-but-not-encrypted message is still perfectly readable by anyone.

A useful way to remember it: encryption is a sealed envelope, a signature is a tamper-proof wax seal with your mark on it. You can use either alone, but for sensitive mail it is common to do both, so the recipient knows the message is private and genuinely from you.

Before You Can Encrypt: You Need the Recipient's Public Key

This is the single point that trips people up most. Because you encrypt using the recipient's public key, you must already have that key imported and marked as accepted in Thunderbird before you can send them an encrypted message. If Thunderbird does not hold a usable key for every recipient, it will not let you send the message encrypted and will tell you which recipient is missing a key.

Signing is different: you sign with your own private key, so you can digitally sign a message to anyone, whether or not you have their key. They only need your public key to verify it, which is why attaching your public key (covered below) is a helpful habit.

Importing and accepting recipient keys is covered in the key setup guide. If you have imported a key but encryption is still refused, open Tools then OpenPGP Key Manager, select the recipient's key, and confirm its acceptance status is set so that the key is trusted for encryption.

Sending an Encrypted or Signed Message

Encryption and signing are chosen per message, in the compose window, at the point of writing. You can set sensible defaults for an account as well (see the next section), but the per-message controls always let you decide for the message in front of you.

Step by step in the Write window

1. Start a new message as usual with Write, and fill in the recipient and subject.
2. In the Write window toolbar, find the encryption controls. Depending on your Thunderbird version these appear as a padlock Encryption button and a Security dropdown (older layouts group everything under a single Security menu, and the classic menu bar exposes the same items under Options).
3. To make the message private, turn on Encrypt (labelled Require Encryption in some versions). The padlock icon closes to show encryption is active.
4. To add your digital signature, turn on Digitally Sign This Message. You can enable signing, encryption, or both.
5. Watch the status indicator. Thunderbird shows whether it has a usable key for every recipient. A green or closed padlock means it is ready to encrypt to everyone on the message; a warning means at least one recipient has no accepted key, and you will need to obtain and import that key first.
6. Send the message as normal. If you enabled encryption but a key is missing, Thunderbird stops you and explains which recipient is the problem rather than sending in the clear by accident.

When you send an encrypted message, Thunderbird also encrypts a copy to your own key. This is intentional: it means the copy saved in your Sent folder remains readable by you later. Without it, you would be unable to reopen your own sent encrypted mail.

Setting Encryption and Signing Defaults for an Account

If you exchange encrypted mail regularly, you can make Thunderbird apply your preferences automatically to new messages from a given account, so you are not toggling the controls every time.

1. Open Account Settings from the menu (or right-click the account in the folder pane and choose Settings).
2. Select the End-to-End Encryption section for the account.
3. Confirm your personal key is selected here. This is the key Thunderbird signs with and the key it uses to keep your own copy of encrypted mail readable.
4. Optionally tick Add my digital signature by default so every new message is signed automatically.
5. Optionally set encryption to be required by default. Bear in mind that a default of "always encrypt" only works when you hold a key for the recipient, so it suits accounts used mainly with a fixed set of correspondents.

Attaching Your Public Key So Others Can Reply Securely

For someone to send you encrypted mail, or to verify your signature, they need your public key. The simplest way to hand it over is to attach it to a message.

In the Write window, open the Security menu and choose Attach My Public Key. Thunderbird adds your public key to the outgoing message. Sharing a public key is safe by design: it can only be used to encrypt mail to you and to verify your signatures, never to read your mail or impersonate you. A common pattern is to sign your first message to a new contact and attach your public key, so they can verify you and reply encrypted from then on.

Reading Encrypted and Signed Mail You Receive

Incoming mail is handled automatically. You do not run a separate decrypt step.

• Encrypted messages are decrypted on the fly using your private key, as long as that key is present in Thunderbird (and unlocked, if you protected it with a master password). The message simply displays as normal readable text.
• Signed messages are verified automatically against the sender's public key. Thunderbird shows the result in the message header area.

The message header carries small status indicators, typically a padlock for encryption and a signature or seal icon for a verified signature. Click the OpenPGP or padlock indicator to open the Message Security panel, which spells out whether the message was encrypted, whether the signature is valid, and which key was used.

Signature results are worth reading rather than glancing at. A good signature confirms the message is genuine and unaltered. An unverified or unknown result usually means you do not yet hold, or have not accepted, the sender's public key: verification is not possible until you import and accept it. A bad or invalid signature is a genuine warning that the message may have been altered or does not match the claimed sender, and should be treated with suspicion.

How Encryption Works With Your Noiz Mailbox

OpenPGP is end-to-end and works on top of your existing Noiz email account, whatever mail server it uses. Your account still sends and receives over the standard Noiz settings (IMAP mail.yourdomain.com on port 993 with SSL/TLS, and SMTP mail.yourdomain.com on port 465 with SSL/TLS, where yourdomain.com is your own domain). The encryption happens in Thunderbird before the message ever leaves your computer, so the Noiz mail servers only ever carry the scrambled ciphertext and never see the plaintext of an encrypted message. Nothing needs to be enabled on the hosting side, and OpenPGP is entirely separate from the transport security (SSL/TLS) that already protects the connection between Thunderbird and the server.

Two practical consequences follow from this on any hosting, including Noiz. Server-side spam and virus scanning cannot inspect the contents of an encrypted message, and neither webmail search nor server-side rules can look inside it. And because only your private key can decrypt stored encrypted mail, that key is the only way back in: if you lose it with no backup, the encrypted messages sitting in your mailbox become permanently unreadable. Keep a secure backup of your private key, as covered in the key setup guide.

Limitations Worth Knowing

• The subject line is not encrypted. OpenPGP protects the message body and attachments, but the subject travels in the clear. Avoid putting anything sensitive in the subject.
• Metadata is not hidden. Who the message is from and to, and when it was sent, remain visible even on an encrypted message. Encryption hides the contents, not the fact that you corresponded.
• Both parties need OpenPGP. Encryption and signature verification only work if the other person also uses OpenPGP-capable software and, for encryption, has shared their public key with you. There is no way to send an OpenPGP-encrypted message to someone who has no key.
• Signing is not encryption. A signed message that is not also encrypted is fully readable by anyone who intercepts it. If confidentiality matters, you must encrypt, not just sign.
• Lose the key, lose the mail. As noted above, there is no password reset for OpenPGP. A lost private key with no backup means lost access to everything encrypted to it.

Troubleshooting

• Symptom: Thunderbird will not let you send encrypted and names a recipient: you do not hold an accepted public key for that person. Obtain and import their public key, mark it accepted in the OpenPGP Key Manager (Tools then OpenPGP Key Manager), then try again.
• Symptom: the Encrypt button is greyed out or missing: no personal key is selected for the account. Open Account Settings, go to End-to-End Encryption, and select (or generate) your personal key first.
• Symptom: a received encrypted message shows as unreadable or asks for a key you do not have: it was encrypted to a different key than the one in this Thunderbird profile, or your private key is missing from this profile. Import your private key into this profile, and make sure the sender used your current public key.
• Symptom: an incoming signature shows as unverified or unknown: you have not imported or accepted the sender's public key yet. Import it and set its acceptance so Thunderbird can verify future messages from that sender.
• Symptom: a signature shows as bad or invalid: treat this as a warning. The message may have been altered, or it may not genuinely be from the claimed sender. Do not act on its contents until you have confirmed the sender's identity through another channel.

OpenPGP is powerful but unforgiving, and the plumbing behind it (keys, transport, mailbox) has several moving parts. If you get stuck sending or reading encrypted mail on a Noiz account, open a support ticket with the Noiz support team. Noiz cannot read or recover your private key by design, but the team can confirm your mailbox and its mail.yourdomain.com connection settings are correct so that you can rule out account issues and focus on the OpenPGP side.