PGP Encryption Guides

What PGP does on a market

PGP lets you encrypt a message so only the holder of a specific private key can read it, and lets you verify that a signed message came from the key owner. On darknet markets the usual jobs are: encrypting your shipping address to a vendor's public key, checking that a market's signed canary or mirror list was not tampered with, and proving your login challenge came from you.

You need your own keypair (public key to share, private key to keep offline), the recipient's public key imported into your keyring, and a client: Kleopatra on Windows, GPG Suite on macOS, or gpg on Linux.

Using PGP on Windows (Kleopatra)

Download Gpg4win from gpg4win.org. Run the installer and keep Kleopatra, GnuPG, and GPA selected. After install, open Kleopatra from the Start menu.

How to Install Kleopatra and Create a PGP Key

In Kleopatra: New Key Pair → Create a personal OpenPGP key pair. Use a pseudonym (first and last name fields are both required — pick something you will recognise in a contact list, not your real name). Skip personal email or use a throwaway. Before clicking Next, open Advanced settings: set key size to 4096 bits and uncheck Key expires unless you want a forced rotation date. Set a strong passphrase and store it offline.

To export your public key: right-click the key → Export. The ASCII block starting with -----BEGIN PGP PUBLIC KEY BLOCK----- is what you paste on a market profile or send to a vendor.

Encrypt and decrypt on Windows

Import a vendor key: copy their public key block → right-click the Kleopatra tray icon → Certificate Import → certify when prompted. Write your message in Notepad, copy it, then tray icon → Clipboard → Encrypt → pick the recipient → paste the ciphertext into the market order form.

To decrypt: copy the ciphertext → tray icon → Clipboard → Decrypt / Verify → enter your passphrase. Plaintext lands on the clipboard.

Using PGP on MacOS (GPG Suite)

Install GPG Suite from gpgtools.org. Open GPG Keychain to generate a key: New → enter alias name and email (optional) → set passphrase.

GPG Suite adds a Services menu entry and Mail integration. For manual encrypt: copy plaintext, open Terminal and run pbpaste | gpg --encrypt --armor -r RECIPIENT_FINGERPRINT | pbcopy, or use the GPG Keychain GUI: select recipient, paste into the encrypt window.

Import keys by dragging a .asc file into GPG Keychain or pasting a key block. Verify fingerprints out of band before trusting a vendor key for address encryption.

Using PGP on Linux

Most distributions ship GnuPG. Install if needed: sudo apt install gnupg (Debian/Ubuntu) or sudo dnf install gnupg2 (Fedora). Tails includes the OpenPGP Applet in the persistence-enabled setups.

Generate a key: gpg --full-generate-key → RSA and RSA → 4096 bits → set expiry as you prefer → enter name and passphrase. List keys with gpg --list-secret-keys --keyid-format long.

Export public key: gpg --armor --export YOUR_KEY_ID > mykey.asc. Import: gpg --import vendor.asc. Encrypt: gpg --encrypt --armor -r VENDOR_ID message.txt. Decrypt: gpg --decrypt message.asc.

Key management: export, import, revoke, rollover

Kleopatra key management covers the lifecycle after your first keypair exists. These steps apply in Kleopatra and map to equivalent GPG commands on macOS/Linux.

• Backup: Export the secret key (Kleopatra → right-click → Backup secret keys) to encrypted offline storage. Anyone with this file and your passphrase owns your identity.
• Import: Merge someone else's public key before you encrypt to them. After import, compare the fingerprint character-for-character with a second source.
• Revocation: If your private key is compromised, generate a revocation certificate at key creation time (Kleopatra → right-click → Generate revocation certificate) and publish it where your public key is listed. A revoked key must not be used for new messages.
• Rollover: Create a new keypair, sign the new public key with the old one if still available, update market profiles, and retire the old key after a transition window.

Never paste your private key or passphrase into a website — including browser-based "PGP tools." Use local software only.