Why you can trust ZDNET : ZDNET independently tests and researches products to bring you our best recommendations and advice. When you buy through our links, we may earn a commission. Our process

'ZDNET Recommends': What exactly does it mean?

ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.

When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.

ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.


How to encrypt your email (and why you should)

If you send emails with sensitive or private info inside, you should consider email encryption. Here's what to know.
Written by Jack Wallen, Contributing Writer
Reviewed by Min Shin
Person looking at email notification
Witthaya Prasongsin/Getty Images

Data privacy has become absolutely crucial for businesses. And some businesses go to great lengths to protect their data, files, and communications.

But consumers and smaller businesses seem to think that adding extra security isn't worth the extra work required. The problem with this take is anyone who refuses to take the extra steps might find themselves on the wrong end of a data breach.

Also: How to enable end-to-end encryption for Facebook Messenger chats

You might have sent some sensitive information in an innocent email, only to find some bad actor intercepted the message and was able to easily read the content of that email and extract the information.

You don't want that. Even if it does require an extra bit of work on your part, being safe is much better than being sorry.

So what do you do? You encrypt your email (or the email containing sensitive information). 

What is email encryption?

Email encryption is a way to restrict an email such that only the recipient can read it. This works by way of encryption key pairs like so:

  • The recipient creates a GPG key pair (consisting of a public and a private key) and sends the public key to you.
  • You import the public key into your keyring.
  • You then send a message to the recipient's email address (associated with the newly-imported key).
  • The recipient receives the email and can read it because they have the private key that matches the public key you imported.

If the email is intercepted on the way, it cannot be read without the matching private key. That, of course, brings up one crucial issue that cannot be stressed enough -- never share your private key with anyone.

Also: 4 ways to secure your remote work setup

Yes, adding encryption to email does add extra steps to your process, but when dealing with sensitive information, those extra steps will be well worth the effort.

Because every email client does this differently, I'm going to demonstrate using the open-source Thunderbird application. I'm also going to demonstrate how to create your GPG key (using GnuPG), so you can help your recipients generate the necessary key pairs so they can send you their private keys.

Here's how it works.

How to encrypt your email

1. Generate a key pair

I'll be demonstrating on Pop!_OS Linux, but this will work the same way on any platform that supports GnuPG (Linux and MacOS). 

Also: 8 things you can do with Linux that you can't do with MacOS or Windows 

For the Windows OS, you'll need to use Gpg4win.

To generate a keypair, open a terminal window and issue the command:

gpg --full-generate-key

You'll be asked the following questions (answer with the defaults):

  • Please select what kind of key you want:
  • What keysize do you want?
  • Key is valid for?

When prompted, type y to verify the creation of the key. You'll then be required to add a real name, an email address associated with the key, and an optional comment. Finally, you'll be required to type and verify a password for the new key pair. After that, your key is created and ready for export.

2. Export the public key

Next, we need to export the public key so it can then be sent to the person who will need to send you an encrypted email. 

To export the key, issue the command:

gpg --export -a "EMAIL" > public_key

Where EMAIL is the email associated with the key you just generated. Once you've generated the file (named public_key), send it to the person who will be encrypting the email to you.

3. Importing a public key

Next, we need to import the public key that was sent to you. Open Thunderbird, click the Menu button and click Account Settings. 

Also: How to add Send Later functionality to Thunderbird email

In the left sidebar, click End-To-End Encryption and then click OpenPGP Key Manager.

The Thunderbird Account Settings window.

Gaining access to the OpenPGP manager from within Thunderbird.

Screenshot by Jack Wallen/ZDNET

4. Select All Files

Click File > Import Public Key From File, and then make sure to select All Files from the drop-down at the bottom right corner of the window.

Selecting All Files from the Key Manager file import drop-down.

Importing the public key from within the OpenPGP Key Manager.

Screenshot by Jack Wallen/ZDNET

5. Locate the key

Locate the file you saved (the public key from the recipient that will receive your email) and click Open. In the resulting window, select Accepted (unverified) and click OK. The key will be imported and ready to use.

Accepting the public key for Henry Jekyll in the Thunderbird Key Manager.

Importing Henry Jekyll's key might not be the best idea, but I'm going for it.

Screenshot by Jack Wallen/ZDNET

6. Close the Key Manager and compose a new message

Close the Key Manager and go back to the Thunderbird main window. Compose a new message to the email address associated with the encryption key, and then (in the email compose window) click the Security drop-down and click the checkboxes for Require Encryption and Digitally Sign This Message.

Also: How to add Do Not Track to Thunderbird (and why you should)

Send the message as normal, and it will be encrypted such that the only person that can decrypt it is the owner of the private key that matches the public key you imported.

Encrypting an outgoing email in Thunderbird.

Encrypting and signing your new email.

Screenshot by Jack Wallen/ZDNET

And that is how email encryption works. I hope you find this to be much easier than you expect and will inspire you to start using this extra security layer in your email communications.

Editorial standards