PGP (Pretty Good Privacy) started as Phil Zimmermann’s 1991 program for encrypting and decrypting data. What practitioners use today is OpenPGP, the interoperable standard behind tools such as GnuPG (RFC 9580, published July 2024, is the current specification), alongside the commercial PGP product line. It was built for email, but the mechanics work on anything you can put in a file, which is why it has outlasted the problem it was written for.
What PGP actually does
PGP gives you two things: cryptographic privacy and authentication. It gets there by combining symmetric-key cryptography, public-key cryptography and hashing rather than picking one.
Every user holds a key pair. The public key is shared with anyone who wants to encrypt something to you, and the private key stays secret. Symmetric-key cryptography encrypts the actual message, public-key cryptography encrypts the symmetric key with the recipient’s public key, and the recipient’s private key decrypts that symmetric key so the message can be opened. Digital signatures handle the other half of the problem: proving a message came from who it claims to and has not been altered.
How a message moves
Sending: you write the message, encrypt it with a symmetric key, encrypt that symmetric key with the recipient’s public key, and send both.
Receiving: you decrypt the symmetric key with your private key, then use it to decrypt the message.
Where it gets used
Email is the obvious case. Beyond that, OpenPGP encrypts files on disk and in transit, backups, and archives intended for long-term storage; whole-disk encryption belongs to the commercial PGP product line rather than the standard. Signing covers the rest: verifying that a software download is the build the developer published, and verifying identity where authentication depends on a key rather than a password.
The list runs longer than that, though most of it belongs to public-key cryptography in general rather than PGP itself: the same key-pair idea sits behind encrypted messaging apps, web forms protecting submitted data, VPN authentication, the digital certificates that certificate authorities issue, access control for systems and data, and secure FTP transfers. PGP’s own trust model works differently: there is no certificate authority behind a PGP key. You either verify a key directly with its owner or rely on other people who have signed it, the web of trust.
Using it without shooting yourself in the foot
Your private key is the whole system. Never share it, and protect it with a passphrase strong enough to be worth the inconvenience. Verify a public key before you trust it, because encrypting to the wrong key protects the wrong person. Set expiry dates on your keys and rotate subkeys rather than treating a key pair as permanent, and generate a revocation certificate the day you create the key, stored somewhere separate, because the moment you need it is the moment you have lost control of the key.