--- title: Frequently Asked Questions (FAQ) sidebar: label: FAQ order: 4 --- import { Aside } from "@astrojs/starlight/components"; ## How can I obtain and start using GpgFrontend? You can download the latest version of GpgFrontend from [GpgFrontend's Downloads Page](/overview/downloads) and choose the installation method for your platform. ## Which operating systems does GpgFrontend support? GpgFrontend is a cross-platform application that supports Windows, macOS, and Linux, making it accessible to nearly all users for their privacy and data protection needs. ## How do I update GpgFrontend to the latest version? You can always get the latest stable or nightly release from the Downloads Page. On Windows, simply run the new installer. On macOS and Linux, replace the old app or AppImage with the new version. Your settings and keys will be preserved unless noted otherwise in the release notes. ## Why isn't GpgFrontend available on the Apple Store? GpgFrontend is not available on the Apple Store because GnuPG (which GpgFrontend depends on) cannot function properly inside the App Sandbox required by macOS App Store policies. The App Sandbox restricts system-level access needed for secure key management and encryption operations. For full functionality and security, GpgFrontend must be installed outside of the App Store environment. ## How do OpenPGP, PGP, and GnuPG (GPG) relate? - **OpenPGP** is the open standard ([RFC 4880](https://www.rfc-editor.org/rfc/rfc4880)) for encrypted email, files, and digital signatures. - **PGP** was the original proprietary software created in the 1990s; it is now rarely used, but its name is sometimes used informally to mean the OpenPGP standard. - **GnuPG (GPG)** is the most widely used free, open-source implementation of the OpenPGP standard. Today, when people talk about "PGP encryption," they almost always mean the OpenPGP standard, and the tool they actually use is GnuPG (GPG) or another compatible app. GpgFrontend is a user-friendly front-end for GnuPG, making OpenPGP encryption easy for everyone. ## Why does GpgFrontend require GnuPG? GpgFrontend is a user-friendly interface that relies on GnuPG (GPG) to handle all cryptographic operations. This approach provides: - Security: GnuPG is a widely audited and trusted open-source encryption tool. By using it directly, GpgFrontend avoids the risks of re-implementing cryptographic algorithms. - Trust & Control: Users can install and verify their own trusted GnuPG, ensuring transparency and independence. - Compatibility: Delegating crypto operations to GnuPG ensures GpgFrontend works seamlessly with the entire OpenPGP ecosystem (including standard keys, files, and signatures). In short: GpgFrontend is your control panel; GnuPG is the secure engine. ## Why choose GPG/OpenPGP over other encryption solutions? - Open Source and Audited: GPG is open-source, free, and maintained by a broad community. Its code has been reviewed for decades, ensuring security and trust. - No Vendor Lock-In: Fully standards-based. Works across major platforms, email clients, and tools. Your keys and data stay portable. - Comprehensive Features: Supports symmetric/asymmetric encryption, digital signatures, key management, key revocation, and a robust web-of-trust model. - Transparency and Control: All encryption processes are visible and configurable. You decide how your data is secured—no hidden algorithms or automation. - Interoperability: Compatible with any OpenPGP-compliant software, ensuring your data is accessible and exchangeable. Proprietary or closed-source tools may restrict platform compatibility, hide how data is encrypted, or lock you into their ecosystem. ## How secure is GPG? When used correctly, GPG provides strong cryptographic protection: - Strong algorithms and key sizes are available, in line with modern standards. - Open source: Its code is continually reviewed by global experts. - No central data leaks: No major vulnerability has ever led to a mass compromise of GPG private keys. - Common risks arise from user error—weak passphrases, mishandled keys, device malware—not GPG itself. Bottom line: Your keys and passphrase security are just as important as the software you use. ## Has GnuPG ever been successfully attacked? According to the official [GnuPG FAQ 11.8](https://gnupg.org/faq/gnupg-faq.html#successful_attacks): > “If you mean, ‘has GnuPG traffic ever been successfully cryptanalyzed?’, the > answer is a flat ‘no’. We are unaware of any credible reports of any of the > ciphers used in GnuPG having ever been successfully cryptanalyzed.” ## What makes GPG/OpenPGP unique compared to instant messengers or built-in encryption? - No accounts or servers: You don’t need to register or rely on any service—maximum privacy, even with strangers. - Long-term trust: Keys can be used for years, supporting file/email/software signing and “web of trust.” - Works offline: Encrypt/sign files for transfer over any medium, no internet required. - Manual & transparent: Everything is under your control, with no forced automation or cloud syncing. Instant messengers (Signal, Matrix, etc.) are great for real-time communication but require accounts, central servers, and frequent key changes—less suitable for offline or anonymous use. ## When is GPG/OpenPGP the best tool? - Secure file exchange with strangers: Journalists, whistleblowers, or anyone needing anonymous document transfer. - Publishing signed content: Software releases, scientific results, public statements needing long-term verification. - Air-gapped environments: Moving encrypted data between computers never connected to the internet. - Maximum auditability: Every cryptographic operation is visible and inspectable. ## Can I use GPG with keys or data from other programs? Yes. If your keys and encrypted data are in an OpenPGP-compatible format, GnuPG and GpgFrontend can work with them. This includes most keys and data from compliant GPG or legacy PGP programs. ## Why not just use password-based encryption? Public-key encryption (like GPG) is more flexible and secure: - No need to share passwords in advance—just publish your public key. - Anyone can encrypt for you, even if you’ve never met. - Digital signatures prove authorship and integrity. - Keys can be revoked or rotated at any time without breaking old data. ## What if I see "GnuPG not installed correctly"? This issue typically arises when GpgFrontend cannot locate GnuPG on your system. Here are steps to address this based on your operating system: - For macOS Users: Install GnuPG using Homebrew with `brew install gnupg`. - For Linux Users: Install GnuPG via your package manager (apt, yum, etc.). - For Windows Users: New versions include GnuPG; or get it [here](https://www.gnupg.org/ftp/gcrypt/binary/). ## Where can I find more help? For more detailed guidance, refer to the quick start manual available at [Getting Started Guide](/overview/getting-started). ## How do I import or export keys in GpgFrontend? Use the Key Management section to import or export public/private keys. You can also drag-and-drop key files directly into the application's Key ToolBox. ## Can I encrypt and decrypt files as well as text? Yes, GpgFrontend supports both text and file encryption/decryption. Use the dedicated file options in the main interface to protect or unlock files. ## What are Nightly versions? Automatically generated experimental builds with new features/fixes under testing. Less stable than official releases, may have breaking changes, and are not GPG-signed. Not recommended for production. Always verify the SHA256 checksum. Please report feedback/issues on GitHub. ## How does GpgFrontend handle passphrases or PINs? GpgFrontend never processes or stores your GPG key passphrases or smart card PINs. All PIN entry is securely handled by GnuPG’s pinentry, independent from GpgFrontend. For app-specific encryption (e.g., KeyPackage), passphrases/PINs are used only in memory and immediately cleared. Advanced users can enable PIN caching and adjust security levels. ## Can lost passwords or keys be recovered? No, for your security, neither GpgFrontend nor the developer can recover lost passwords or private keys. Make sure to back up your private key and remember your passphrase! ## How does GpgFrontend ensure secure communications? It uses GnuPG to implement OpenPGP with robust encryption algorithms. Only intended recipients can decrypt your messages. ## Does GpgFrontend support OpenPGP smart cards or tokens? Yes, if your GnuPG supports smart cards. Manage your smart cards directly via the SmartCard Controller. ## Is GpgFrontend available in my language? GpgFrontend supports multiple languages. You can change the display language from the `Settings > General` tab. Want to help translate? See the [contribution guide](/appendix/translate-interface) on GitHub! ## What data does GpgFrontend collect? GpgFrontend does not collect or transmit any personal or usage data. All cryptographic operations are performed locally. Update checks can be disabled, and no tracking or analytics are built in. ## How can I request a new feature? You can suggest new features by opening an issue on GitHub or contacting the maintainer directly. ## Found a bug? If you encounter any issues with GpgFrontend, please report them via the GitHub repository. You can also contact me directly if you're not on GitHub; see the [Contact](/overview/contact) section for details. ## Interested in contributing? Feel free to modify GpgFrontend's code and submit a Pull Request with your enhancements. You can also send patches via email if you prefer to contribute anonymously.