How to use PGP to protect your files in any cloud storage

Cloud storage, such as Google Drive, Dropbox, iCloud or Nextcloud, is handy. The catch is that the company running it can normally read your files. It can also be forced to hand them over, or be hacked. The fix is simple: lock the files yourself before they leave your device. The cloud then stores only scrambled data. This is called client-side encryption, or "using your own encryption".

This guide shows how to do it with PGP, a long-trusted, free and open standard. You do not need computer skills. Go slowly and follow the steps in order.

The most important rule: if you lose your key or forget your passphrase, your files are gone forever. Nobody can reset it for you, not even the cloud company. Read the section on backing up your key before you encrypt anything you care about.

How it works in plain words

• You make a key pair: a public key and a private key.
• The public key is like an open padlock. Anyone can use it to lock something. It is safe to share.
• The private key is the only key that opens the padlock. Keep it secret and protected by a passphrase (a long password).
• To store a file in the cloud, you lock it with your public key, then upload the locked file. Later you download it and unlock it with your private key.

There is also a simpler way for files only you will read, called passphrase-only (symmetric) encryption. There is no key pair, only one passphrase that locks and unlocks the file. It is easier but you must never lose or forget that passphrase.

PGP or Cryptomator? Which should I use?

If you want a folder that works like a normal one, see how to set up Cryptomator. If you want to lock specific files or backups, or share locked files with another person, use PGP.

What you need

• A PGP app: OpenKeychain on Android (see how to use OpenKeychain), and Kleopatra (part of Gpg4win) on Windows, GPG Suite on a Mac, or Kleopatra on Linux. Get each one from its official website, and check it as described in how to download apps safely.
• A cloud account. It can be any provider. It never needs to know you are using PGP.
• A safe place to keep a backup of your private key, away from the cloud.

Step 1: Make your key pair

On the phone with OpenKeychain:

1. Open OpenKeychain and tap Create my key (or the plus button, then create a new key).
2. Type your name and an email address. They can be a nickname and an address you use for this. They are only labels.
3. Create the key and, when asked, set a strong passphrase. Use four or more random words, for example "river candle orbit tractor". Write it on paper and keep it somewhere safe.

On a computer with Kleopatra:

1. Open Kleopatra and choose New Key Pair (or File, then New Key Pair).
2. Choose Create a personal OpenPGP key pair.
3. Enter a name and an email address, then continue and set a strong passphrase when asked.

Step 2: Back up your private key (do not skip this)

1. In your PGP app, find your key and choose Export (or Backup) the secret key (also called the private key).
2. Save it as a file and also write down your passphrase on paper.
3. Keep copies in two safe places that are not the same cloud account: for example a USB stick kept at home, and a second one kept elsewhere. Do not store the key unlocked in the same cloud as your files.

If both your phone and your computer are lost, this backup is the only way to open your files.

Step 3: Lock a file before you upload it

Locking a single file:

1. In your PGP app, choose Encrypt (on a phone, this might be under Encrypt Files).
2. Pick the file. For a whole folder, first squash it into one file: right-click the folder and choose Compress or Send to, Compressed (zipped) folder, then lock the zip file.
3. Choose to encrypt for yourself: select your own key as the recipient. (On a computer, tick your own key. In OpenKeychain, choose your own key.)
4. Press Encrypt. You get a new file that ends in .gpg, .pgp or .asc. Only this new file goes to the cloud.
5. Upload the .gpg file to your cloud storage as normal.
6. Delete the original unlocked file from the cloud or from your upload folder, if you do not need it any more. See how deleting really works and how to shred files with BleachBit to remove it properly.

The cloud can still see the file name, its size and when you uploaded it. Give files plain names such as "backup-oct" rather than "passport-scan". To hide names too, lock a zipped folder and name the zip something dull.

Step 4: Get a file back and open it

1. Download the .gpg file from the cloud.
2. Open your PGP app and choose Decrypt (or open the file with the app).
3. Enter your passphrase.
4. Your original file appears. Save it, use it, and delete the unlocked copy when you are done.

Step 5: Lock a file with a passphrase only (the simple option)

1. In your PGP app choose Encrypt, and look for the option Encrypt with passphrase (or symmetric).
2. Type a long passphrase, and confirm it.
3. Upload the locked file.

To open it, choose Decrypt and type the same passphrase. This is easier for backups, but there is no second chance if you forget the passphrase.

Step 6: Share a locked file with another person (optional)

1. Ask the person for their public key (a file or a block of text beginning with "BEGIN PGP PUBLIC KEY BLOCK").
2. Import it into your PGP app. Check with them by another route, such as a call, that it is really theirs.
3. When you encrypt, choose their key as well as your own. Only they and you can open the file.
4. Upload it to any cloud and send them the link. They unlock it with their private key.

Good habits

• Back up your key and passphrase (Step 2). This is the number-one cause of lost data.
• Lock first, then upload. Never upload the unlocked file "just for a moment".
• Use a strong, long passphrase that you do not use anywhere else.
• Keep a second copy of important locked files in another place, in case the cloud account is closed.
• Test it. Before you lock your only copy of something, lock a small test file, download it back and open it.
• Keep your PGP app up to date.

What PGP does not protect

• It does not hide that you have a cloud account, or how much you store.
• It does not protect a file once it has been unlocked on your device. Look after the device. See how to harden your GrapheneOS settings.
• It does not protect against someone who gets your passphrase.
• It does not replace backups. If a file is deleted or damaged, the locked file is gone too.

If something goes wrong

• "No secret key" or "cannot decrypt": the file was locked for a different key. Use the right key, or import your backup key.
• You forgot your passphrase: there is no reset. If you wrote it down, find the paper. If not, the file cannot be opened.
• The file will not open on another device: import your key backup into the PGP app on that device first.
• A very large file is slow: this is normal. Lock it once, then upload and be patient.