How to use Kleopatra to encrypt and decrypt with PGP

Kleopatra is a free app for managing PGP keys and for encrypting, decrypting, signing and verifying text and files. It works as a front end for GnuPG, the program that does the actual encryption. On Windows it comes with Gpg4win, and on Linux you can install it from your distribution.^[1][2] Here’s how to do each job, step by step.

The steps follow Gpg4win 5.1.1, the current Windows version as of November 2026.^[3] Labels can differ slightly between versions and on Linux. If PGP keys are new to you, start with what a PGP key is.

What is Kleopatra?

Kleopatra is an open-source certificate manager and graphical front end for encryption, made by the KDE community. It handles OpenPGP keys, the kind PGP uses, and S/MIME (X.509) certificates, another standard for encrypted email.^[1] Kleopatra calls keys “certificates”, and lists your own key pairs and other people’s public keys together.

On Windows, Kleopatra is part of Gpg4win, the official GnuPG package for Windows, maintained by GnuPG’s developers. Gpg4win also installs GnuPG itself, the Outlook add-in GpgOL and GpgEX, which adds encryption to File Explorer.^[2] On Linux, use your distribution’s package manager or Flathub.^[1]

How do you install Gpg4win and Kleopatra on Windows?

1. Download the installer from gpg4win.org, Gpg4win’s official site, and nowhere else. As of November 2026 the current version is 5.1.1, released on 23 September 2026, which includes GnuPG 2.5.24.^[3]
2. The download page invites you to pay what you want, and one of the amounts is 0.^[4]
3. Before you run the installer, check who signed it. It should be signed by g10 Code GmbH, and Windows normally shows that name as the publisher when you open the file. The site also lists checksums to compare.^[5]
4. Run the installer and keep the default components. Gpg4win 5 is built for 64-bit Windows.^[3] You can also use the installer to update an older version: your keys and settings are kept.^[4]
5. Open Kleopatra from the Start menu.

How do you create a PGP key pair in Kleopatra?

1. If your list is empty, click New Key Pair on Kleopatra’s welcome screen. Otherwise, choose File › New OpenPGP Key Pair.
2. Enter your name, your email address or both. They become your key’s user ID, which anyone with your public key can see.
3. Make sure Protect the generated key with a passphrase is ticked, then click OK.
4. When asked, choose a strong passphrase and enter it twice. Store it somewhere safe: GnuPG’s FAQ says its developers can’t help you if you lose it.^[6]
5. Kleopatra confirms that the certificate was created and shows its fingerprint, the long code that identifies your key.

The window’s Advanced options let you change the key type (Key Material) and expiry date; if you’re not sure, keep the defaults. Gpg4win 5 added post-quantum Kyber keys, designed to resist future quantum computers,^[3] but they’re new, so check that your contacts’ software can use them first. Our guide to PGP vs GPG explains which key types work where.

How do you back up your secret key?

Do this straight away. Without a backup, a dead disk or a lost laptop locks you out of everything encrypted to that key.

1. Select your key in the list. Keys whose secret half you hold appear in bold.^[7]
2. Choose File › Backup Secret Keys. Since Gpg4win 5.1.0, this option is no longer in the right-click menu.^[3]
3. Enter your passphrase if asked, and save the file. Kleopatra suggests a file name containing SECRET.
4. Copy the file to offline storage, such as an encrypted USB stick, and delete other copies from your computer.

When GnuPG creates a key, it also saves a revocation certificate in the openpgp-revocs.d folder inside its home folder.^[8] On Windows, that home folder is %APPDATA%\gnupg.^[9] Keep a copy with your backup and store it like an important document. If you lose the key or forget its passphrase, it lets you revoke the key, telling people to stop using it.^[6]

To back up everything at once, including your settings and other people’s keys, copy the whole %APPDATA%\gnupg folder; Kleopatra can encrypt it with a password first. Unless your key is on a smartcard, that backup contains your secret key, so store it just as carefully, and repeat it regularly.^[9]

How do you share your public key?

1. Select your key and click Export on the toolbar.
2. Save the file. Kleopatra suggests a name containing “public” and ending in .asc. It holds only your public key, as text that starts with -----BEGIN PGP PUBLIC KEY BLOCK-----.
3. Send the file, or paste its text, wherever people can find it: an email, your website or a profile page.

To let people find your key by email address, select it and choose File › Publish on Server, which uploads it to the keyserver set in Kleopatra’s settings. Never send anyone your secret-key backup: Export shares your public key, while Backup Secret Keys copies your private one.

How do you import someone’s public key in Kleopatra?

1. Get their public key: ask them for the file, download it from their website, or click Lookup on Server and search by email address. Wherever it comes from, check it as below.
2. Click Import and choose the file. If the key is text you’ve copied, choose Tools › Clipboard › Certificate Import instead.
3. Kleopatra asks whether to certify the new certificate and suggests ways to check its fingerprint, such as a phone call. Choose Do Not Certify Now until you’ve checked.
4. Double-click the key to open its details, including its fingerprint.^[7] Ask the owner for their fingerprint, in person or on a call, and check that the two match.^[6]
5. If they match, select the key and click Certify. Tick the user IDs to certify, choose your own key next to Certify with, and click Certify.

Certifying marks the key as checked, so Kleopatra treats it as valid. Under the dialog’s advanced options, leave Certify for everyone to see (exportable) unticked to keep your certification on your own computer.

How do you encrypt text with Kleopatra’s Notepad?

1. Click Notepad on the toolbar. In Gpg4win 5 it opens in a separate window.^[3]
2. Type your message. Write it here rather than on a web page: the Tails developers warn that JavaScript attacks can reach confidential text typed in a browser.^[10]
3. Choose who can read it: add each recipient’s key under Encrypt for others, and tick Encrypt for me if you want to read it later. Or choose Encrypt with password to use a password you share instead.^[10]
4. Click Encrypt Notepad. If Sign as is ticked, the button reads Sign / Encrypt Notepad, and the message is signed as well.^[10]
5. Copy the result, from -----BEGIN PGP MESSAGE----- to -----END PGP MESSAGE-----, into your email or chat.

Can you encrypt from the clipboard?

Yes. Copy the text, then choose Tools › Clipboard › Encrypt in Kleopatra and pick the recipients. Kleopatra puts the encrypted text back on the clipboard, ready to paste. The same menu has Decrypt/Verify for messages you’ve copied. Other apps can read the clipboard too, so don’t leave decrypted text there.

How do you encrypt a file with Kleopatra?

1. Click Sign/Encrypt and choose the file. In File Explorer, GpgEX also adds encryption options to the right-click menu.^[2]
2. In the Sign/Encrypt Files dialog, add recipients under Encrypt for others, or choose Encrypt with password.^[10]
3. Click the button to finish. Kleopatra saves an encrypted copy, usually ending in .gpg, next to the original.

How do you decrypt with Kleopatra?

• A message: open Notepad, paste the whole message, including the BEGIN and END lines, and click Decrypt / Verify Notepad.^[10]
• A file: click Decrypt/Verify and choose the file.^[10] Kleopatra shows the result and lets you save the decrypted file.

Either way, a small window asks for your passphrase. Kleopatra can only decrypt messages encrypted to a key whose secret half is on this computer. For other devices, see how to decrypt a PGP message.

How do you sign and verify with Kleopatra?

A signature shows that a message or file came from the holder of a particular key and hasn’t changed since.

• To sign text, tick Sign as in Notepad, choose your key, untick the encryption options and click Sign Notepad. The result is readable text with your signature attached.
• To sign a file, click Sign/Encrypt, choose the file, tick Sign as and untick the encryption options. Kleopatra saves a separate signature file, usually ending in .sig, to send with the original.
• To verify, paste signed text into Notepad and click Decrypt / Verify Notepad, or click Decrypt/Verify and choose a signature file. If the signed file isn’t beside it under the same name minus .sig, Kleopatra asks you to pick it.

Then read the result. You want a good signature from a key you’ve certified. If Kleopatra says the signature is valid but the certificate’s validity is unknown, you haven’t yet confirmed whose key it is: check the fingerprint and certify it. A bad signature means the content doesn’t match the signature, for example because it was changed, so don’t trust it.

What do Kleopatra’s common errors mean?

Mantis plans to offer on-device OpenPGP tools too, keeping PGP keys separate from its chat and wallet keys.