Encrypt email on Windows with Kleopatra

About 20 minutes. Windows only. Works with Gmail, Outlook, or any other email.

You don’t have to switch email providers to start encrypting. You also don’t need to type commands into a black terminal window. Gpg4win is a free, open-source package for Windows, and Kleopatra is the friendly program that comes with it.

Two keys, one mail slot

Remember the locked mailbox with a slot in the door:

• Your public key is the slot. You hand it out freely. Anyone can use it to lock a message for you.
• Your private key opens the box. It never leaves your computer, and you never share it.

To write to someone, you lock the message with their public key. Only their private key can open it.

Step 1: Install Gpg4win

1. Go to gpg4win.org and download the installer. Only download it from there.
2. Run it and keep the default choices. Make sure Kleopatra is ticked.
3. Open Kleopatra from the Start menu.

Step 2: Make your key pair

1. Click New Key Pair.
2. Enter your name and the email address you’ll use it with.
3. Kleopatra asks for a passphrase. This protects your private key if someone gets onto your computer. Make it long, like four or five random words, and save it in your password manager.
4. Click OK. Your new key appears in the list.

You’ll see an expiry date on your key. That’s normal and a good thing. You can extend it later with a couple of clicks.

Step 3: Back up your private key

If your computer dies and you have no backup, you can never read your old encrypted mail again. Do this now:

1. Right-click your key and choose Backup Secret Keys (some versions say Export Secret Keys).
2. Save the file to a USB stick, not just your computer. Keep that stick somewhere safe.

Never email this file, or upload it anywhere. It’s the key to your mailbox.

Step 4: Share your public key

1. Right-click your key and choose Export.
2. Save the file. It ends in .asc.
3. Send it to the people you want to hear from, or put it on your website. This one is safe to share.

Step 5: Import a friend’s key, and check it

1. Get their public key file, like mine.
2. Drag it into Kleopatra, or click Import and pick the file.
3. Double-click their key to see its fingerprint, the long string of letters and numbers.
4. Compare it with the fingerprint they gave you some other way: in person, on a phone call, or on their business card. They must match exactly. This is how you know nobody swapped the key on the way to you.

If they match, Kleopatra may offer to certify the key. That’s just you telling Kleopatra, “I checked this one.” Go ahead.

Step 6: Send your first encrypted message

1. Click Notepad in Kleopatra’s toolbar.
2. Write your message in the box.
3. Open the Recipients tab and choose your friend’s key. Leave your own key ticked too, so you can read what you sent later.
4. Click Encrypt Notepad.
5. Your message turns into a block of scrambled text starting with -----BEGIN PGP MESSAGE-----. Copy all of it, including the first and last lines.
6. Paste it into a normal email in Gmail or Outlook and send it.

That scrambled block is all Google or Microsoft will ever see.

Step 7: Read an encrypted reply

1. Copy the whole scrambled block from the email.
2. Paste it into Kleopatra’s Notepad.
3. Click Decrypt / Verify Notepad and type your passphrase.

The message appears in plain words. If they signed it, Kleopatra also tells you whose key signed it.

What this doesn’t hide

• The subject line, and who you sent it to, are never encrypted. Keep subjects boring.
• If someone has access to your unlocked computer, they could read things while you have them open.

Tired of copying and pasting?

Use Thunderbird. Once your keys are in it, encryption becomes a single button when you write an email.

Menu names in Kleopatra change a little between versions. If something here doesn’t match your screen, look for the closest wording.