Publication context
This article expands on a reflection originally published on LinkedIn on February 17, 2026. The content is deliberately kept in its original context. Some of these reflections have since evolved and will be the subject of separate articles.
For a long time, GPG carried, in my mind, the image of a tool reserved for a handful of specialists — people who sign their emails, publish key fingerprints on their personal website, and for whom cryptography is almost its own discipline. It wasn't the kind of tool I pictured myself using day to day, without any particular training.
Five years later, GPG is part of my reflexes, on par with backing up a file or locking my computer. What follows isn't a tutorial. It's a field report on how this tool moved from technical curiosity to silent habit.
Why I got interested in GPG
The starting point wasn't spectacular. I was looking for an alternative to VeraCrypt, which I used to store sensitive files in an encrypted vault. The principle works well, but it imposes a constraint I eventually found cumbersome in practice: to access a single file, you have to mount the entire volume, open it, then remember to unmount it afterward. One isolated file, one one-off need, and yet a whole mechanism to set in motion around it.
Digging into alternatives, I came back to GPG — a tool I knew by name without ever really having used it. The difference in logic caught my attention right away: instead of a single vault holding everything, GPG lets you sign and encrypt files independently, one at a time, with no overarching structure to manage. Each file becomes its own unit of confidentiality, without depending on a volume that would need to stay open or closed.
That shift in model matched how I actually work: isolated files, created and consulted as things come up, rather than a uniform stock of sensitive documents to protect as a block.
The uses I actually make of it
Looking back, my use of GPG comes down to three very concrete needs, unrelated to the use cases we spontaneously associate with cryptography — transactions, end-to-end encrypted exchanges, ultra-sensitive communications.
Attesting a file's origin. When I share a document whose authenticity might matter — a data export, a deliverable, an archive — I can sign it. The signature doesn't encrypt anything: it simply attests that the file genuinely came from me, in a verifiable way, without anyone having to take my word for it.
Verifying a document's integrity. A signed file that's been modified, even slightly, has its signature invalidated immediately. I use this for my own archives: knowing that a document I find again two years later hasn't been altered in the meantime, neither by an accidental manipulation nor by silent corruption.
Encrypting notes for my "future self." This is the most personal of the three. Some reflections, some logs, some notes I take at a given moment aren't meant to be read by anyone — not even by me right away, but by the version of me who'll reread them months or years later. Encrypting them guarantees they stay sealed until that moment, without depending on a third party's discretion or an online service's security.
Five years of use
What this practice brings me, day to day, has less to do with the technology itself than with a relationship of trust built over time.
Trust in my archives: I know that what I signed years ago remains verifiable today, without having had to actively monitor those files in the meantime. Document integrity: I've never had to wonder whether a file had "moved" — the signature answers that question immediately, with no ambiguity. Privacy of personal notes: I can write freely, knowing the content stays inaccessible until I choose to decrypt it myself.
What matters, fundamentally, isn't the encryption algorithm used or the protocol's theoretical robustness. It's the trust this practice let me build toward my own data — a trust that holds over time, independent of the technological evolutions around it.
It's not paranoia
Presented this way, using GPG can come across as excessive caution, almost generalized distrust. That's not how it feels in practice, though. It follows the same logic as other habits we no longer question today.
Nobody considers using a password manager paranoid. Nobody finds it strange to run regular backups, or to turn on two-factor authentication on their important accounts. These practices have become silent standards of digital hygiene — we apply them without thinking, because the cost is low and the benefit, should the need arise, considerable.
GPG occupies exactly that same place in my daily life. It isn't a reaction to a specific threat. It's a background habit, one that never draws attention until you need it — and that, on the day you do need it, makes all the difference.
Three commands are enough to get started
What surprised me most, discovering GPG, was how simple getting started is compared to the tool's reputation. No particular ceremony, no complex configuration for a first use:
gpg --gen-key
gpg --encrypt file.txt
gpg --decrypt file.txt.gpg
Generate a key pair, encrypt a file, decrypt it. Three commands, and the core of the initial need is already covered. The rest — signing, keyring management, public key exchanges — comes later, at the pace of actual needs, without requiring mastery of everything from day one.
Conclusion
Five years after my first attempts, GPG remains, for me, a discreet tool, almost invisible in my daily use — precisely because it stopped being a technical curiosity and became a habit.
This reflection on mastering my digital identity doesn't stop here. It keeps refining itself, along with my usage and the tools I discover. This post is just one step in that path.