How To Encrypt Files With PGP | Secure Data With OpenPGP

Encrypting files with PGP requires the recipient’s public key and an OpenPGP-compatible tool like GnuPG.

One wrong key makes the file unrecoverable. PGP encryption keeps a file readable only by the intended recipient by combining symmetric and public-key cryptography. The process is direct once you have the right tool and a working command. Here is exactly how to encrypt a file using PGP, the tools that work across operating systems, and the mistakes that lock you out.

How PGP File Encryption Works

PGP encrypts the file itself with a one-time symmetric session key, then encrypts that session key with the recipient’s public key. The recipient’s private key decrypts the session key, which decrypts the file. A digital signature can be added to prove the file came from you and detect tampering in transit. Because PGP follows the OpenPGP standard, different tools that support OpenPGP can exchange encrypted files without compatibility problems.

What You Need Before You Encrypt

You need two things: the recipient’s PGP public key and an OpenPGP-compatible encryption tool. GnuPG (GPG) is the most widely used command-line tool and works on Linux, macOS, and Windows. The recipient must have kept the corresponding private key secret and available on their own system.

• Recipient’s public key – usually provided as an .asc or .gpg key file.
• An OpenPGP tool – GnuPG (free), Broadcom PGP Command Line (enterprise), or a built-in workflow engine like AWS Transfer Family.
• Your private key (optional) – if you want to sign the file to prove origin.

Encrypt A File With PGP – The Command Line Method

The most stable, universal method for PGP encryption is the command line using GnuPG. The process never changes between Linux, macOS, and Windows (with Gpg4win installed).

1. Import the recipient’s public key into your local keyring:
   gpg --import recipient-public-key.asc
2. Encrypt the file using the recipient’s email address or key ID. The AWS Transfer Family documentation uses this exact pattern:
   gpg --encrypt -r recipient@email.com --openpgp test-file.txt
3. The output file is test-file.txt.gpg. Send that file to the recipient through your usual channel.

The --openpgp flag forces strict adherence to the OpenPGP standard, which avoids interoperability issues with other tools. The -r flag identifies which public key to use. If the recipient has multiple keys, the email address ensures the correct one is selected.

AWS’s official PGP encryption guide provides a full walkthrough of the command-line method, including key generation with RSA 3072-bit keys and the exact gpg syntax shown above.

Encrypting Files With PGP In Enterprise Environments

Enterprise tools automate PGP encryption inside scheduled file transfers. GoAnywhere Open PGP lets you import a trading partner’s key into its Key Vault, then attach a PGP Encrypt task to a Project that picks up files from local folders, UNC paths, or NFS mounts. Microsoft System Center Orchestrator’s PGP Encrypt File activity requires specific GnuPG binaries (version 1.4.10 or later, or GnuPG version 2.x components including gpg-agent.exe, libgcrypt-20.dll, and others) placed in the Orchestrator extensions encryption folder. Missing those files breaks the activity entirely.

Broadcom PGP Command Line offers the same pgp --encrypt syntax with an --output flag to control the encrypted file name. The command pgp --encrypt (input) --recipient (user) matches the core GnuPG pattern, so teams switching tools don’t need to rewrite workflow logic.

The Most Common PGP Encryption Mistakes

Encrypting Files With PGP: The Core Steps To Remember

The exact workflow fits in five steps. Run through them in order and the encrypted file will open cleanly on the other side.

1. Obtain and verify the recipient’s public key fingerprint.
2. Import the key into your local GPG keyring (gpg --import recipient-key.asc).
3. Run the encrypt command with the correct recipient email or ID (gpg --encrypt -r recipient@email.com --openpgp file.txt).
4. Confirm the output file ends in .pgp or .gpg.
5. Send the encrypted file over your usual channel—email, SFTP, or cloud storage.

PGP encryption is one of the few cryptographic methods that has remained stable for decades. The same command that worked on a Linux server ten years ago works today, and the OpenPGP standard guarantees that the file you send will open in any compliant tool the recipient uses.