GnuPG (gpg) encrypts and signs files. On servers its most practical job is protecting backups: database dumps and archives should be encrypted before they leave the server for cloud storage or another provider. It’s also how you verify that a downloaded package or release really comes from its author.

Two ways to encrypt

Mode How Good for
Symmetric One passphrase encrypts and decrypts Quick one-offs, simple scripts
Public key (asymmetric) Encrypt with the recipient’s public key, and only their private key decrypts Backups: the server only needs the public key

Public-key encryption is ideal for backups. The server can encrypt but can’t decrypt, so an attacker who compromises the server can’t read the stored backups.

Symmetric encryption (passphrase)

gpg --symmetric --cipher-algo AES256 backup.sql
# creates backup.sql.gpg; asks for a passphrase
gpg --output backup.sql --decrypt backup.sql.gpg

In scripts, avoid passing passphrases on the command line, where they’re visible in ps and shell history. Use a file with restricted permissions:

gpg --batch --yes --pinentry-mode loopback --passphrase-file /root/.backup-pass \
    --symmetric --cipher-algo AES256 -o backup.sql.gpg backup.sql

Public-key encryption

1. Create a key pair (on your own computer, not the server)

gpg --full-generate-key

Choose the default (ECC/Curve 25519, or RSA 4096), a name and email, an expiry, and a strong passphrase. List keys:

gpg --list-keys
gpg --list-secret-keys

2. Export the public key and import it on the server

gpg --armor --export [email protected] > backup-pub.asc     # on your computer
scp backup-pub.asc server:/root/

On the server:

sudo gpg --import /root/backup-pub.asc
sudo gpg --edit-key [email protected]     # then type: trust → 5 (ultimate) → quit

Setting trust avoids “There is no assurance this key belongs to the named user” prompts in scripts. Alternatively, use --trust-model always in the encrypt command.

3. Encrypt on the server

gpg --encrypt --recipient [email protected] -o shop.sql.gpg shop.sql

Stream directly from the dump, without an unencrypted file on disk:

mysqldump --single-transaction shop | gzip | \
  gpg --batch --yes --trust-model always --encrypt --recipient [email protected] \
  -o /var/backups/shop-$(date +%F).sql.gz.gpg

Then upload it with rclone, restic or rsync. See database backup automation.

4. Decrypt (on your computer, where the private key is)

gpg --decrypt shop-2026-10-14.sql.gz.gpg | gunzip > shop.sql

Test restores regularly. An encrypted backup you can’t decrypt, because of a lost private key or forgotten passphrase, is no backup.

Protect the private key

  • Keep it off the server. Back it up offline: an encrypted USB stick, a password manager, or a printed paper backup (paperkey).
  • Export a backup: gpg --armor --export-secret-keys [email protected] > private.asc (store it very safely).
  • Create a revocation certificate: gpg --gen-revoke [email protected] > revoke.asc.
  • Consider adding a second recipient (--recipient twice), such as a colleague or an offline escrow key, so one lost key isn’t fatal.

Sign and verify files

Verify downloads. Many projects publish .asc or .sig signatures:

gpg --keyserver keys.openpgp.org --recv-keys KEYID      # or import the project's key file
gpg --verify software.tar.gz.asc software.tar.gz
# "Good signature from …" + check the key fingerprint against the project's website

APT repositories use the same mechanism. That’s why you add a repository’s key to /etc/apt/keyrings/. See adding repositories.

Sign your own files:

gpg --armor --detach-sign release.tar.gz      # creates release.tar.gz.asc

Alternatives

  • age — a modern, simpler file encryption tool (age -r PUBLICKEY file > file.age). It’s great for backups if you don’t need GPG’s ecosystem.
  • restic / Borg — backup tools with built-in encryption, deduplication and retention. That’s often easier than DIY gpg scripts. See backup strategy.
  • OpenSSL enc — possible, but easy to misuse. Prefer gpg or age.

Quick reference

Task Command
Encrypt with passphrase gpg -c --cipher-algo AES256 file
Create key pair gpg --full-generate-key
Export public key gpg --armor --export ID > pub.asc
Import key gpg --import pub.asc
Encrypt for recipient gpg -e -r ID -o file.gpg file
Decrypt gpg -d file.gpg > file
Verify signature gpg --verify file.asc file
Sign gpg --armor --detach-sign file

Related: openssl commands and SSH keys.

  • Security
  • Linux
  • Encryption