Gpg4win: review, download and setup

What is Gpg4win used for?

Gpg4win combines cryptography tools for Windows. The Kleopatra graphical interface helps to manage keys and certificates, encrypt files, and verify signatures. Such a set is useful when the document needs to be passed to a particular recipient or check who signed the received file.

Select the task before the start of work. When encrypting, you restrict the reading of content. When signing, give the recipient the opportunity to check the integrity and connection of the file with the signatory key. The signature itself does not hide the document, and the presence of a key with the right name does not prove the identity of its owner.

Gpg4win and Kleopatra: check the recipient's key

To transfer an encrypted file, you need a public key of the recipient. Import it to Kleopatra and check the full print through an independent agreed channel. The email address in the key properties is convenient to read, but it is technically possible to substitute a similar name in another key. Do not confirm the trust only on the familiar name.

When encrypting another person, consider your own copy. If the file is encrypted only on its key, your secret key will not necessarily allow you to open the result. First, send a small test document, check the read at the addressee and your own recovery. Keep the originals until successful verification.

Download Gpg4win from the official website

Select the supported platform on the project page. The link leads to the selection of the distribution, and does not start the installation automatically.

Use the official download address. Check the signature or checksum if the project publishes one. Keep secret configuration files private when contacting support.

Getting started with Gpg4win

1. Download Gpg4win from the official page and check the distribution and signature information.
2. Open Kleopatra and create your own pair of keys or import the desired existing key.
3. Save a secure backup of the secret key and information for its withdrawal.
4. Get the addressee's public key and check the print separately from the key file itself.
5. Encrypt the test document, carefully check the list of recipients and the ability to read your own copy.
6. For the signed file, separately check the signature and specify which key it corresponds to.

Gpg4win interface and illustrations

Interface screenshots

The origin of the images is indicated in the sources below. The interface of the installed version may differ.

Gpg4winCertificate Management in Kleopatra from the Gpg4win set

1 / 2

Enlarge

1 of 2. Gpg4win: Certificate Management in Kleopatra from the Gpg4win set

12

Gpg4winCertificate Management in Kleopatra from the Gpg4win set · 1 / 2

Original in a new tab

Limitations and data protection in Gpg4win

The secret key cannot be sent as a contact card. An open part is used for exchange. The private key password and backup require separate storage; the loss of both access methods can make the old encrypted documents inaccessible.

The official Compendium helps to understand the principles, but the project warns that its old editions do not describe all the details of the current interface. The names of the menu items and windows from the screenshots may differ. Check the action on the selected key, recipients and the result of the operation, and not just match the image buttons.

Alternatives for related tasks

PeaZip is easier for one-time transfer of the archive with an agreed password. Gpg4win is suitable for public key exchange and signature verification. VeraCrypt creates encrypted volumes, and Cryptomator organizes encryption of files in the storage: these are other ways to work with data, not to replace the signature verification.

Documentation and images