🔐 “What the heck is a GPG key?” (I finally figured it out so you don’t have to)

Guides, Tutorials and Best Practices
1

Ever seen “sign your commits with GPG” or “send me your public key”… and just nodded like you understood? :sweat_smile:

Yeah, same.

I went down the rabbit hole recently and tried to break it down in plain English — no crypto PhD required.

:thinking: So… what is a GPG key (really)?

Super simple version:

  • GPG = tool for encryption + signing

  • It helps you:

    • :locked: Encrypt stuff → only the intended person can read it

    • :white_check_mark: Sign stuff → prove it actually came from you

And every GPG setup has 2 parts:

  • :incoming_envelope: Public key → you share this with people

  • :key: Private key → you guard this with your life (seriously, never share it)

Think:

Public key = your email address
Private key = your email password

:technologist: Where you’ll actually see this in real life

This isn’t just theory — you’ll run into GPG in:

  • :white_check_mark: Git commit signing (GitHub “Verified” badge)

  • :white_check_mark: Encrypting emails

  • :white_check_mark: Signing packages/software downloads

  • :white_check_mark: Securing sensitive files (API keys, backups, etc.)

:gear: First step: Check if you even have GPG installed

Quick check:

On Mac/Linux:

gpg --version

On Windows (CMD/PowerShell):

gpg --version

If that fails, try:

gpg2 --version

If you see version info → you’re good
If not → you’ll need to install GnuPG

:wrench: How to generate a GPG key (the easy way)

Run this in your terminal:

gpg --full-generate-key

Then just follow the prompts:

  • :locked_with_key: Key type: RSA and RSA

  • :straight_ruler: Key size: 4096 bits

  • :hourglass_not_done: Expiry: ~1 year (you can renew later)

  • :identification_card: Name + Email: use your GitHub/email identity

  • :key: Passphrase: make it strong (don’t be lazy here)

Once done, you’ll get a key fingerprint / ID — that’s your identifier.

:outbox_tray: Sharing your public key

You’ll need this for GitHub or sending encrypted messages.

Export it like:

gpg --armor --export your@email.com

Then:

  • Paste it into GitHub

  • Share with friends/teammates

  • Upload to a key server if needed

:warning: Mistakes that can mess you up

Learn from my paranoia:

  • :cross_mark: Sharing your private key

  • :cross_mark: Weak passphrases (“password123”… c’mon :sob:)

  • :cross_mark: Not backing up your key

  • :cross_mark: No revocation plan if it gets compromised

:shield: Basic security habits (that actually matter)

  • :white_check_mark: Treat your private key like a password vault

  • :white_check_mark: Use a strong passphrase (long > complex)

  • :white_check_mark: Backup your key securely (USB / password manager)

And this one is underrated:

:backhand_index_pointing_right: Generate a revocation certificate right away

gpg --gen-revoke your@email.com

``

If things go wrong, this is your “kill switch.”

:game_die: Fun (but nerdy) way to practice

Try this with a friend:

  • Exchange public keys

  • Encrypt something random (like an UNO move :joy:)

  • Send it and decrypt

Congrats, you are now playing Encrypted UNO™

:speech_balloon: Question for the community

  • Do you actually use GPG regularly, or just for GitHub commits?

  • Any horror stories of lost keys or broken setups?

  • Is it worth the effort for beginners, or overkill?

Would love to hear how you all approach this — I feel like GPG is one of those “everyone says use it, but few explain it well” tools.

4 Likes