I hate PGP
NOTE: Check out this post’s sister post where I talk about my current, horrid state.
You know, I’ve been noticing that a sizeable portion of my blog posts are about things I hate or dislike. Oh, well.
I am the world’s biggest hater of PGP (or GPG), which is surprisingly isolating in the cybersec world in 2026. There’s this widespread illusion that PGP is just “the way” to establish secure communications over the internet. “It’s just secure,” they say.
And, let me be clear: most of the time, yes, PGP is “sufficiently secure”. There is no single magical vulnerability that puts your ciphertexts at risk. The primitives are solid, the software is battle-tested. My problem with PGP is its design philosophy and mode of use.
There are plenty of strange design decisions. A notable example is the packet format, famous for being ancient and unnecessarily convoluted. OpenPGP packets have a lot of weird edge cases and parsing complexity, and complex parsers are historically where vulnerabilities live. Heartbleed wasn’t a crypto failure; it was a parsing failure, same principle.
The design philosophy is broken at the core. PGP is a single monolithic program that bites more than it can chew. You can use it for:
- Authentication
- Identity
- Plaintext encryption
- File encryption
- Email encryption
- I could go on
That’s just way too much for a single program to handle. Separation of concerns aside, it turns what could be a collection of highly specialized, independently audited tools into a ginormous sprawling legacy swiss knife.
Key management is just plain bad. It puts the burden of key generation, renewal, and distribution on the user; modern cryptographic features, such as forward secrecy, are outright missing. Modern security-focused software knows not to entrust us with security-related tasks, and for good reason: man is the single biggest point of attack surface in secure communications.
Thus, keyservers were conceived. But have those EVER been good? They are a mess and put too much trust in a central server - so much for the decentralized internet, am I right?
The main use case for PGP is supposedly email. Trying to secure email is a lost cause, as email is inherently insecure! Even with PGP, too much metadata is leaked for body encryption to even matter in any meaningful way.
PGP relies on the “web of trust” model, which is an archaic, utopian 90’s pipe dream that completely falls apart in reality. Still, it’s so widespread socially that it remains prevalent in cybersecurity spaces.
So why do we still use PGP? Two reasons:
- Nothing can quite replace it.
- It makes users feel in control, possibly because of its steep learning curve.
I, too, foolishly thought that PGP was good and secure, partly because it was hard to learn. It felt advanced, but in retrospect, I couldn’t have been more wrong. It turns out, the most secure cryptographic utilities are the ones that avoid relying on the user.
Signal is, in my opinion, a very good example of cryptography done right. Nobody using Signal is thinking about the X3DH key exchange or the double ratchet algorithm; they’re just texting.
Still under the hood, it’s transparently performing genuinely sophisticated security mechanisms for you, the user: forward secrecy, break-in recovery, key transparency… the user does not have to lift a finger.
It is largely thanks to this seamlessness that the application is so secure. Communicating with the same level of security in PGP would take so much manual work that it may as well not be possible.
So, if PGP sucks so much, what do we use? Well, no 1:1 replacement for PGP would be good, as the idea for PGP itself is misguided at best. Instead, you should use multiple programs for specific things.
For example, check out age for file encryption or minisign for cryptographic signatures. They do one thing, they use modern primitives (like X25519 and ChaCha20-Poly1305), and they don’t try to be an identity platform, an email encryption standard, and three other things all at once.
I think that, as the cybersec community, we need to collectively move on from PGP.
Just let a system do the work for you. Man is the biggest attack vector in cryptographic systems anyway.
Published on 2026-06-30