GPG
Ranked 4 of 7 encryption tools by recommenders
Free, long-standing tool for encrypting and signing files, email and commits, and for SSH keys via gpg-agent. Critics call its user experience poor and say it lacks forward secrecy.
Free, long-standing tool for encrypting and signing files, email and commits, and for SSH keys via gpg-agent. Critics call its user experience poor and say it lacks forward secrecy.
52 people gave an opinion
- recommend it
- 23
- criticize it
- 29
- approval share
- 44%
Recommended in 11 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 23 people recommend itNeeds 10 or more, met.
- 0.7 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 11 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Works with SSH via gpg-agent
“I use GPG with SSH (or SSH with GPG) all the time, and I need gpg-agent for that.”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “gpg-agent was valuable to me because it let me use `pass` in scripts”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “Finally, use GPG for SSH.”
Comment from 24 Nov 2025 in “Native Secure Enclave backed SSH keys on macOS” - Comment from 23 Nov 2025 in “Native Secure Enclave backed SSH keys on macOS”
Strong encryption, hard to break
“And Snowden used gpg and I haven't heard of a single message of his having been decrypted.”
Comment from 13 Dec 2025 in “Poor Johnny still won't encrypt” “the most advanced intelligence in the world can't break it”
Comment from 4 Jan 2026 in “The PGP Problem (2019)” Open source with no corporate control
“you're not trusting any corporation to do what they say they are doing, or not changing it out from under you”
Comment from 5 May 2026 in “Instagram Encrypted Messaging Ends on Friday, May 8” “gpg has the advantage that there is no money in it”
Comment from 3 Jan 2026 in “The PGP Problem (2019)”
What people warn about
Each mark is one comment
Poor UX and high barrier to entry
“GPG would be great for this concept, but it's probably not as accessible as to get people to paste a JSON somewhere”
Comment from 8 Mar 2026 in “Lightweight protocol to assert authorship of content and vouch for humanity of” “Web of trust has been a miserable failure because of the GPG's horrible UX and high entry barrier.”
Comment from 2 Jun 2026 in “Why Janet?” “GPG is a mess which could lead to things not working properly”
Comment from 4 Jan 2026 in “The PGP Problem (2019)” Key management and migration problems
“Depending on them is extra tedious on top of the tediousness of any PGP keyrings”
Comment from 28 Dec 2025 in “Gpg.fail” “I've also had inexplicable issues migrating GPG keys cross-platform”
Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite” Lacks forward secrecy, weak for untrusted senders
“GPG specifically is much too insecure when you need to receive messages from untrusted senders”
Comment from 28 Dec 2025 in “Gpg.fail” “GPG doesn't support forward secrecy, which is table stakes for encrypted messaging these days.”
Comment from 5 May 2026 in “Instagram Encrypted Messaging Ends on Friday, May 8” Criticized as outdated, little real impact
“GPG has ever really achieved anything other than allowing crypto nerds to proclaim that things were encrypted or signed”
Comment from 27 Dec 2025 in “Gpg.fail” “gpg is an awful dead and outdated tool you'd never enforce on your worst enemy”
Comment from 24 Nov 2025 in “Show HN: I just fixed .env once and for all – better-env”
Other encryption tools people recommend
The four most recommended other encryption tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| age encryption tool | 49 | 12 | 80% | 11 | — | Approved |
| GnuPG | 40 | 46 | 47% | 8 | — | — |
| PGP | 38 | 48 | 44% | 12 | 25 yrs3 owners | — |
| GPGThis page | 23 | 29 | 44% | 11 | — | — |
| Cryptomator | 18 | 2 | 90% | 10 | — | Approved |
What people said
40 of the 61 comments that mention it, newest first. Each links to the original comment.
“Or use fido/gpg in a yubikey”
“The signing process doesn't recursively traverse the bytes of the commit to pull them into GPG, like you would expect.”
“Nothing quite gives the user that feedback that PGP gives of seeing raw ciphertext unlocked with a key.”
“It would be fairly difficult to backdoor GPG in that case without getting caught.”
“All email problems can be solved with GPG”
“Web of trust has been a miserable failure because of the GPG's horrible UX and high entry barrier.”
“It's that the tools willingly emit bad data because of bad error handling”
“you're not trusting any corporation to do what they say they are doing, or not changing it out from under you”
“GPG doesn't support forward secrecy, which is table stakes for encrypted messaging these days.”
“Learn Mutt and GPG too, it's about 20 minutes of your life”
“Before someone says Linux offers GPG signing it's mostly useless without a central PKI.”
“GPG would be great for this concept, but it's probably not as accessible as to get people to paste a JSON somewhere”
“Encrypt sensitive documents with age or gpg”
“GPG-encrypting whole files makes every commit a full-file diff.”
“I've also had inexplicable issues migrating GPG keys cross-platform”
“GPG has had tons of vulnerabilities in signature verification”
“It is the exact thing this system needs”
“watch them pull out GPG the second a government mandates their comms backdoored”
“The "web of trust" model that PGP/GPG supports is not the ideal means of implementing this.”
“I have numerous criticisms of the GPG system but it's not a solution to just not implement any solution at all”
“GPG is a mess which could lead to things not working properly”
“the most advanced intelligence in the world can't break it”
“gpg has the advantage that there is no money in it”
“They, and other communities that use GPG-encrypted emails are LARPing”
“GPG specifically is much too insecure when you need to receive messages from untrusted senders”
“Depending on them is extra tedious on top of the tediousness of any PGP keyrings”
“If you want to LARP at security with a handful of other folks, GPG is a fine way to do that.”
“Everything is better than PGP (not just GPG --- all PGP implementations).”
“GPG has ever really achieved anything other than allowing crypto nerds to proclaim that things were encrypted or signed”
“unlike gpg, they do have to specify --cleartext explicitly for Sequoia, so there is no confusion going on that case”
“things like sudo, ssh, gpg, maybe systemd”
“And Snowden used gpg and I haven't heard of a single message of his having been decrypted.”
“gpg is an awful dead and outdated tool you'd never enforce on your worst enemy”
“Finally, use GPG for SSH.”
“I had no issues, none, using gpg or using a passphrase on my ssh keys.”
“gpg-agent was valuable to me because it let me use `pass` in scripts”
“Literally everyone uses it, even non-techies.”
“I use GPG with SSH (or SSH with GPG) all the time, and I need gpg-agent for that.”
“gave up because no one else was doing it and it was annoying”
“GPG does tons of other things that you will find are very useful”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.