GnuPG Cheatsheet

These are important but not so commonly used. Therefore, I noted down some critical parts of it in case I need them in the future.

Create Keys

The interactive way:

gpg --expert --full-gen-key

Delete Keys

Delete Subkeys

$ gpg --edit-key $KEYID
gpg> list
gpg> key 1
gpg> delkey
gpg> save

Delete Specific Secret Keys

$ gpg-connect-agent "HELP DELETE_KEY" /bye
# DELETE_KEY [--force|--stub-only] <hexstring_with_keygrip>
# Delete a secret key from the key store.  If --force is used
# and a loopback pinentry is allowed, the agent will not ask
# the user for confirmation.  If --stub-only is used the key will
# only be deleted if it is a reference to a token.

To delete a specific secret key (secret master key or secret subkey), you have to first obtain the target secret key’s keygrip. Then use the keygrip to delete the correct secret key:

gpg --list-secret-keys --with-keygrip starbops@hey.com
gpg-connect-agent "DELETE_KEY $KEYGRIP" /bye

Sign Data

Content with signature in binary format (generates $FILE.gpg):

gpg --local-user $SIGNING_KEYID --sign $FILE

Content with signature in ASCII format (generates $FILE.asc):

gpg --local-user $SIGNING_KEYID --sign --armor $FILE

Content followed by signature in ASCII format (generates $FILE.asc):

gpg --local-user $SIGNING_KEYID --clear-sign $FILE

Only signature in binary format (generates $FILE.gpg):

gpg --local-user $SIGNING_KEYID --detach-sign $FILE

Only signature in ASCII format (generates $FILE.asc):

gpg --local-user $SIGNING_KEYID --detach-sign --armor $FILE

Interact with Other People

When you go to some key-signing parties, you might exchange fingerprints with people (maybe it’s on your business card)

Upload Public Keys

There’re several public GPG key servers. You have to upload your public key to one of them.

  • keyserver.ubuntu.com
  • keys.openpgp.org
  • pgp.mit.edu
  • pgp.uni-mainz.de
  • pgp.net.nz
gpg --keyserver $KEYSERVER --send-keys $KEYID

Download Other People’s Public Key

gpg --keyserver $KEYSERVER --recv-keys $KEYID

Or, if you don’t know what the ID is for the key, specify the UID (email address):

gpg --keyserver $KEYSERVER --search-keys $UID

After you download their public keys, you could check their signatures, sign them, or use them to encrypt data, then transfer the protected data back to their owner via email. Lots of things could be done!

Oh, BTW, if you encounter any Network is unreachable issue during sending, receiving, or even searching keys on any keyserver, try this. Make sure you add this line in your ~/.gnupg/dirmngr.conf:


To make the config take effect, reload dirmngr process by:

gpgconf --reload dirmngr

Now you should be all good. I encountered this on my M1 Mac mini environment. Not sure what the root cause is. Maybe it’s a bug on the M1 version of gpg.

Sign Public Keys

Signing other people’s public keys is a very serious thing. You should check the key’s fingerprint with its owner face to face. If not possible, schedule a video meeting. This is to keep the authenticity of the key, making sure that the key owner owns the key you’re going to sign.

To sign a public key, you can do the following (if you have multiple keys in your GPG keyring, you have to decide which key is the signing key with --default-key $SIGNING_KEYID or --local-user $SIGNING_KEYID):

gpg --local-user $SIGNING_KEYID --sign-key $TARGET_KEYID

Or, if you prefer the interactive way:

$ gpg --local-user $SIGNING_KEYID --edit-key $TARGET_KEYID
gpg> list
gpg> sign
gpg> save

Check Key Signature

gpg --check-sigs $KEYID