PGP
Ranked 3 of 7 encryption tools by recommenders
Recommended for free, widely supported encryption and signing with public keys; the main caveat is that key management is hard for most people.
Recommended for free, widely supported encryption and signing with public keys; the main caveat is that key management is hard for most people.
86 people gave an opinion
- recommend it
- 38
- criticize it
- 48
- approval share
- 44%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 25 years
Median of the 3 owners who said how long they have had it.
Each square is one year.
Why it doesn’t carry the badge
- 38 people recommend itNeeds 10 or more, met.
- 0.7 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Mature standard with many implementations
“no other tooling or spec has that covered with multiple competing implementations to choose from as well as PGP”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “New software that is compatible with any keys generated with ciphers from the last decade. Compatibility wins.”
Comment from 28 May 2026 in “Are we self-sovereign PKI yet?” Ties keys to real people
“PGP actually solves the problem of which key actually belongs to which person”
Comment from 26 May 2026 in “Are we self-sovereign PKI yet?” “A PGP key is the only standardized cryptographic passport for the internet”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “the only IETF standard built for human-identity-bound signing with keys held by those humans”
Comment from 9 Apr 2026 in “Open Source Security at Astral” - Comment from 26 May 2026 in “Are we self-sovereign PKI yet?”
Built-in verification and web of trust
“PGP provides the tools (fingerprint verification, web of trust, key signing), but you have to actually use them.”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “The PGP people were doing the right thing when they were doing education in the form of key signing parties.”
Comment from 13 Sep 2026 in “How Trail of Bits helps verify the integrity of Signal chats” “the actually hardest problem with humans using cryptography, that PGP puts front and center”
Comment from 13 Nov 2025 in “Switching from GPG to Age” Decentralized, no single trusted party
“Encrypted email is the only neutral decentralized and IETF standard comms tool we have.”
Comment from 28 May 2026 in “Are we self-sovereign PKI yet?” “Signal isn’t owned by the users and independent of third parties the way PGP/GPG is”
Comment from 15 Oct 2026 in “Why I Wrote PGP (1991, revised 1999)” “the "least bad" option to avoid any single point of trust or failure”
Comment from 13 Nov 2025 in “Switching from GPG to Age”
What people warn about
Each mark is one comment
Key management too hard for most
“PGP had the right idea, but the system is too hard for the average person.”
Comment from 12 Jun 2026 in “Digital Sovereignty Becomes an Imperative as the US Reads Dutch Emails” “You still have to use PGP which means creating public/private key pairs, store them correctly, and understand when to use the public key and when to use the private key.”
Comment from 16 Oct 2026 in “Why I Wrote PGP (1991, revised 1999)” “In overall PGP failed over the last 30 years, sharing public keys with other people was always the biggest difficulty for real adoption.”
Comment from 16 Dec 2025 in “Nature's many attempts to evolve a Nostr” - Comment from 26 Mar 2026 in “I tried to prove I'm not AI. My aunt wasn't convinced”
Dated, complex packet format
“the archaisms in PGP are not merely a consequence of the GnuPG implementation, but also deeply embedded into the standard itself”
Comment from 13 Nov 2025 in “Switching from GPG to Age” “PGP's packet design and the state machine that falls out of it is a knock-on effect of how many things PGP tries to do”
Comment from 28 Dec 2025 in “Gpg.fail” “PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.”
Comment from 15 Oct 2026 in “Why I Wrote PGP (1991, revised 1999)” - Comment from 16 Oct 2026 in “Why I Wrote PGP (1991, revised 1999)”
Easy to use insecurely
“The blog post just reeks of "I can't use it, too complex for me therefore it sucks". Yeah, it can be misused, I do not deny that.”
Comment from 14 Nov 2025 in “Switching from GPG to Age” “It's so easy to use insecurely that I will argue that employees setting up PGP keys and then potentially trying to use them does weaken the company's security posture.”
Comment from 13 Nov 2025 in “Switching from GPG to Age”
Other encryption tools people recommend
The four most recommended other encryption tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| age encryption tool | 49 | 12 | 80% | 11 | — | Approved |
| GnuPG | 40 | 46 | 47% | 8 | — | — |
| PGPThis page | 38 | 48 | 44% | 12 | 25 yrs3 owners | — |
| GPG | 23 | 29 | 44% | 11 | — | — |
| Cryptomator | 18 | 2 | 90% | 10 | — | Approved |
What people said
40 of the 161 comments that mention it, newest first. Each links to the original comment.
“You still have to use PGP which means creating public/private key pairs, store them correctly, and understand when to use the public key and when to use the private key.”
“The packet format is awful, full of complexity, backwards compatibility mess, and serious security problems.”
“I never encountered any significant difficulties and could successfully exchange messages with my peers”
“Signal isn’t owned by the users and independent of third parties the way PGP/GPG is”
“It was great fun teaching people to use it and actually having a community to use it with.”
“I actually like the fact that you see the raw ciphertext as opposed to everything happening in the background.”
“PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.”
“The PGP people were doing the right thing when they were doing education in the form of key signing parties.”
“If you’re not running PGP commands yourself to encrypt and read your messages, it’s not secure.”
“PGP had the right idea, but the system is too hard for the average person.”
“The world quietly runs on "dead" PGP technology so deeply that any calls for a complete replacement”
“Encrypted email is the only neutral decentralized and IETF standard comms tool we have.”
“All of them completely missed the boat on the problems PGP solves that none of the alternative do”
“New software that is compatible with any keys generated with ciphers from the last decade. Compatibility wins.”
“PGP solves the problem it was designed to solve for the groups that need it most”
“PGP actually solves the problem of which key actually belongs to which person”
“why PGP is still the best and most widely used and useful proof-of-human and self-sovereign PKI solution that exists”
“The UX is strictly better than the commonly suggested hodge podge of flavor of the week alternatives.”
“we can use the existing standard (RFC-4880) in a way that is completely secure”
“the only IETF standard built for human-identity-bound signing with keys held by those humans”
“PGP is dead outside of niche geek circles exactly because key management is basically an unsolvable problem for the average person”
“It doesn't have a great UX, it isn't used outside of its narrow niches, but it exists and does exactly this.”
“reputation and web-of-trust models have been tried with mixed results (see PGP/GPG history)”
“I never saw a single speck of anything I ever sent to anyone via PGP in there.”
“If there's one thing we learned from Snowden is that the NSA can't break PGP”
“encrypt any messages through PGP even if the service you're using is already "e2e encrypted"”
“PGP's packet design and the state machine that falls out of it is a knock-on effect of how many things PGP tries to do”
“In overall PGP failed over the last 30 years, sharing public keys with other people was always the biggest difficulty for real adoption.”
“The blog post just reeks of "I can't use it, too complex for me therefore it sucks"”
“The blog post just reeks of "I can't use it, too complex for me therefore it sucks". Yeah, it can be misused, I do not deny that.”
“the actually hardest problem with humans using cryptography, that PGP puts front and center”
“the "least bad" option to avoid any single point of trust or failure”
“PGP provides the tools (fingerprint verification, web of trust, key signing), but you have to actually use them.”
“A PGP key is the only standardized cryptographic passport for the internet”
“I stand by PGP for the use cases we recommend it for today as the least bad option for those use cases.”
“It's so easy to use insecurely that I will argue that employees setting up PGP keys and then potentially trying to use them does weaken the company's security posture.”
“the archaisms in PGP are not merely a consequence of the GnuPG implementation, but also deeply embedded into the standard itself”
“Everyone seems to be trying to re-solve problems with ssh keys that PGP actually solved reasonably well.”
“IMO OpenPGP, however aged the spec design, when used with modern tools in turn using the unified smartcard interfaces, is still a way better choice”
“no other tooling or spec has that covered with multiple competing implementations to choose from as well as PGP”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.