PGP in practice: what it is good for

PGP gets a bad reputation, some of it deserved. Used carefully for the right purposes, it remains one of the few ways to make an email unreadable to the servers that carry it.

Good uses

• Sending sensitive documents to someone who also uses PGP.
• Receiving vulnerability reports from researchers.
• Signing messages so recipients can verify they were not modified.

Limits

• Subjects and headers are not encrypted in most clients.
• Both sides need a working setup.
• If your device is compromised, encryption does not help.

Minimal setup

gpg --quick-generate-key "you@itpromail.com" ed25519 sign,cert 2y
gpg --quick-add-key  FINGERPRINT cv25519 encr 2y
gpg --export --armor you@itpromail.com > public.asc

Back up your secret key somewhere offline, set an expiry you will actually remember, and publish your public key through Web Key Directory so correspondents can find it. Our PGP guide walks through the account-side steps.

Related reading

• Web Key Directory Explained: How Clients Discover Public Keys
• Protected Headers and Encrypted Subjects in PGP and S/MIME Mail
• Planning for Lost PGP Keys: Revocation Certificates and Backups