PGP lets you sign and encrypt mail to people outside SipherMail. Your key work happens in your browser. It is separate from end-to-end encryption, which only works between SipherMail users.
Set up a key#
- Open Settings > Encryption and find PGP keys.
- Choose Generate a PGP key, enter your name, the addresses the key covers and an optional expiry, then pick a passphrase. Keys use Curve25519.
- Or choose Import a private key to bring in a key you already have.
Your private key is encrypted with your passphrase before it is stored. The passphrase is checked in your browser and is never sent to the server. It cannot be recovered, so download an Encrypted backup and keep it somewhere safe.
You can keep several keys. Make default picks the signing key. Revoke marks a key invalid, and Delete removes it.
Share your public key#
- Publish adds the key to the SipherMail directory so other members can find it. For domains you have added in your account, the key is also served from the standard web key directory, so other PGP clients can find it from your address.
- Export public key gives you the armored key to send by hand.
SipherMail never queries public keyservers.
Send signed or encrypted mail#
In the composer, open PGP and S/MIME, choose PGP, then turn on Sign message, Encrypt message, or both. The panel shows each recipient’s key status.
- If any recipient has no usable key, the message is not sent encrypted. You can fix the recipient list or choose Send unencrypted instead.
- The subject line is not encrypted.
- Attachments are placed inside the encrypted message.
- It cannot be combined with end-to-end encryption, expiring messages or scheduled send. AI tools are switched off in the composer while Encrypt is on.
Keys found through a contact, the directory or the recipient’s domain are used, but marked as unverified. Choose Trust key after you have confirmed the fingerprint with the person.
Read PGP mail#
Encrypted messages are decrypted in your browser, and you are asked for your passphrase if the key is locked. The decrypted text is not sent to the server. Signed messages show one of these badges:
| Badge | Meaning |
|---|---|
| Verified by key | The signature matches a key you trust. |
| Unknown key | The signature is valid for a key you have not trusted. |
| Invalid signature | The message changed after it was signed, or the signature does not match. |
If a message carries a public key, SipherMail offers it with Trust this key. It is never trusted automatically.