Use GnuPG (the gpg command) when a VPS must exchange messages that are both confidential and verifiably from a known sender. Encrypt with the recipient’s public key, sign with your own secret key, and let the recipient decrypt with their secret key and verify your signature with your public key. The combined operation is:
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
gpg --armor
--local-user YOUR_SIGNING_FINGERPRINT
--recipient RECIPIENT_FINGERPRINT
--output message.txt.asc
--sign --encrypt message.txtThis guide covers key preparation, fingerprint checks, binary and text-safe output, decryption, signature verification, unattended VPS operation, and recovery from common failures.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What encryption and signing each accomplish
GPG performs OpenPGP key management, encryption, signing, decryption, and verification. Encryption and signing solve different problems, so decide whether a message needs one or both.
| Operation | Key used by sender | Key used by recipient | What it provides |
|---|---|---|---|
| Encryption | Recipient’s public key | Recipient’s matching secret key | Confidentiality: only the holder of the matching secret key should be able to recover the plaintext. |
| Signing | Sender’s secret key | Sender’s public key | Origin authentication and tamper detection: a valid signature shows that the signer controlled the secret key and that the signed data has not changed. |
| Sign and encrypt | Sender’s secret key plus recipient’s public key | Recipient’s secret key plus sender’s public key | Confidentiality and authenticated origin in one OpenPGP message. |
A signature does not hide content, and encryption alone does not prove who created the plaintext. For a private message whose origin matters, combine --sign and --encrypt.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prepare the VPS safely
Use a dedicated account
Run GPG under the Unix account that owns the application or administrative workflow. Do not copy a secret key into a shared system account merely because a scheduled job runs there. The account’s home directory contains the GnuPG home, normally ~/.gnupg, including private-key material, trust data, sockets, and configuration.
Restrict ownership and permissions so other users cannot read the directory. A typical check is:
Free tools Windows power users keep installed
One-click scans. No signup required.
ls -ld ~/.gnupg
ls -l ~/.gnupgIf you create or repair the directory, make the account its owner and use restrictive permissions such as mode 700 on the directory. Apply the same principle to exported secret-key backups and any decrypted message files.
Install the distribution package
On Debian or Ubuntu, install the distribution’s GnuPG package with the normal package manager. The exact package split and version depend on the release; a common package name is gnupg:
sudo apt update
sudo apt install gnupgOther distributions use different package managers and may split GnuPG into several packages. Confirm the installed command and version:
gpg --versionRead the manual on the VPS with man gpg. Option defaults, pinentry behavior, and scripting details should be checked against the installed version before you automate a production workflow.
Create or import the keys you need
Generate a new OpenPGP key pair
Generate a key pair interactively with:
gpg --full-generate-keyThe prompts select the key type, size or algorithm, expiration, identity, and passphrase. Choose an identity that your correspondents can recognize and set an expiration policy appropriate for your organization. The passphrase protects use of the secret key; it is not a replacement for filesystem permissions or encrypted backups.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
When generation completes, list public and secret keys separately:
gpg --list-keys
gpg --list-secret-keysRecord the complete fingerprint shown for the key. A short key ID is too small to be a reliable identifier and can collide with another key. Use the full fingerprint in deployment records, recipient selections, and operational documentation.
Import an existing key
If the key pair was created elsewhere, import the relevant certificate file:
gpg --import keyfile.ascImport the public certificate when you only need to encrypt to or verify a correspondent. Import the secret key only into the account that must sign or decrypt, and transfer it through a controlled, encrypted channel. After importing, run both listing commands and compare the displayed full fingerprint with the value supplied by the key owner.
Save the revocation certificate
GnuPG creates a revocation certificate for a generated key. The Debian manual documents the openpgp-revocs.d location inside the GnuPG home. Store a protected copy somewhere separate from the VPS, preferably in encrypted backup storage. If the secret key is lost or compromised, publishing that certificate tells correspondents to stop trusting the key. Keep the certificate available even when the key is otherwise offline; without it, a lost secret key may remain difficult for others to retire.
Verify a recipient’s public key before encrypting
Encryption only works for a recipient whose public-key certificate you possess. Obtain that certificate from the correspondent or an agreed key-distribution system, then verify its full fingerprint over an independent channel such as a separately authenticated conversation. Do not treat an emailed key file or an unverified download as proof of identity.
After checking the fingerprint, select the key by its full fingerprint in commands. This avoids ambiguity if multiple keys have similar names or short IDs. Also check that the key is not expired or revoked before sending. A successful encryption command does not by itself prove that the key belongs to the intended person.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Encrypt a file for one or more recipients
Binary output for file transfers
When the transport accepts arbitrary binary files, create a compact encrypted file:
gpg --output message.txt.gpg
--recipient RECIPIENT_FINGERPRINT
--encrypt message.txtThe original message.txt remains unchanged, while message.txt.gpg contains the encrypted data. GPG can encrypt to more than one public key by repeating --recipient; each listed recipient can then decrypt a copy with their own secret key.
ASCII armor for text-only transport
If the encrypted object must pass through a text-only system, add --armor:
gpg --armor
--output message.txt.asc
--recipient RECIPIENT_FINGERPRINT
--encrypt message.txtASCII-armored output is larger but uses printable text and is easier to paste into systems that do not preserve binary attachments. Do not choose armor merely because the filename ends in .asc; choose it because the transport requires text safety. For normal file transfer, binary .gpg output is preferable.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCreate signatures
Detached signatures
A detached signature leaves the original file readable and creates a separate signature file. This is useful when recipients already have the file, need to archive it unchanged, or want to verify it independently:
gpg --local-user YOUR_SIGNING_FINGERPRINT
--output message.txt.sig
--detach-sign message.txtDistribute message.txt and message.txt.sig together, along with your public key or a trusted way to obtain it. Changing even one byte in the message causes verification to fail.
Select the signing key explicitly
GPG otherwise uses its configured default secret key. --local-user selects the signing identity explicitly, which is safer on a VPS that contains keys for more than one service or person. The option accepts the full fingerprint.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Sign and encrypt in one operation
For a confidential message whose recipient must also authenticate its origin, combine the operations:
Recommended Free Tools
gpg --armor
--local-user YOUR_SIGNING_FINGERPRINT
--recipient RECIPIENT_FINGERPRINT
--output message.txt.asc
--sign --encrypt message.txtGPG signs with the selected secret key and encrypts the resulting message to the recipient’s public key. The recipient needs both the matching secret key for decryption and your public key for signature verification. If several people must decrypt the message, repeat --recipient for every verified public key.
Armor is optional in this combined command. Remove --armor and use a .gpg output name when the delivery channel accepts binary data.
Decrypt and verify on the receiving VPS
Decrypt a combined message
Run:
gpg --output message.txt --decrypt message.txt.ascGPG uses the recipient’s secret key to recover the plaintext. When the encrypted data contains a signature, GPG also reports signature verification during decryption. Read the diagnostic output and confirm that the reported signer fingerprint is the one obtained through an independent channel. A decrypted file is not automatically trustworthy if the signature is missing, invalid, or made by an unexpected key.
Verify a detached signature
Import or otherwise make the signer’s public key available, then verify both files explicitly:
gpg --verify message.txt.sig message.txt--verify checks the detached signature without producing a replacement copy of the signed content. Treat a “good” cryptographic result as only one part of the decision: compare the signer fingerprint, check the key’s expiration and revocation state, and ensure the verified filename is the file you intended to process.
Choose the right format and workflow
| Decision | Use this when | Trade-off |
|---|---|---|
| Recipient-key encryption | Different correspondents need to exchange messages without sharing one password. | Each recipient needs a verified public key, and their matching secret key must remain available for decryption. |
| Symmetric encryption | A small, controlled group can exchange a shared passphrase through a separate secure channel. | Every authorized party knows the same secret; distributing, rotating, and protecting that passphrase becomes the central risk. GPG invokes this mode with --symmetric. |
| Binary output | The transport accepts arbitrary attachments or files. | Compact, but systems that expect text may corrupt or reject it. |
| ASCII armor | The message must pass through text-only mail, tickets, or copy-and-paste workflows. | Larger than binary output and still dependent on correct key handling. |
| Detached signature | The original file should remain directly usable or independently archived. | Two files must stay associated, and the verifier must supply both paths. |
| Combined signed-and-encrypted message | One artifact should provide confidentiality and origin authentication. | The recipient must have the decryption secret key and the signer’s public key. |
| Interactive administration | A human is present to approve a signing or decryption operation. | Pinentry and gpg-agent can safely request the passphrase, but the job depends on an interactive session. |
| Automation | A scheduled service or deployment pipeline performs repeatable operations. | Use documented batch and machine-readable status interfaces, with strict secret handling; never parse human-readable messages as a protocol. |
Protect secret keys and passphrases on an unattended VPS
Keep secrets out of commands and logs
Do not put a secret-key passphrase in shell history, source code, process arguments, issue trackers, or ordinary log files. Command-line arguments can be visible to other processes or captured by monitoring. Let gpg-agent and a suitable pinentry method handle interactive entry. For scheduled jobs, design a documented batch workflow that supplies authorization through a controlled mechanism and captures machine-readable status, rather than scraping prompts or human-readable diagnostics.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Back up and test restoration
Back up the secret key and its revocation certificate through a controlled, encrypted channel. Keep the backup separate from the VPS so a host compromise or disk failure does not destroy both copies. Test restoring the key on an isolated machine before relying on the backup. A backup that has never been restored is an assumption, not a recovery plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review key state before each production send
Check that the selected key is current, not expired, and not revoked. Keep deployment records keyed by full fingerprint. If a secret key may have been exposed, stop using it for new signatures, use the revocation certificate, and distribute the revoked status to correspondents. Do not silently replace a compromised key while leaving recipients unaware of the old one.
Separate plaintext handling from encrypted storage
Encryption protects the message in transit and at rest as an encrypted file, but the plaintext exists briefly during signing, encryption, decryption, or application processing. Limit its permissions, avoid writing it to shared temporary directories, remove it according to your retention policy, and ensure backups do not retain an unencrypted copy unintentionally.
Automate without weakening verification
Start by making the manual process reliable: identify keys by full fingerprint, verify expected fingerprints, and define whether each output is binary, armored, detached, or combined. Then reproduce those decisions in the service account’s configuration.
- Use explicit
--output,--recipient, and, when signing,--local-useroptions rather than relying on whichever key happens to be the default. - Use GPG’s documented batch and status interfaces for scripts. Record exit status and machine-readable status events, and keep human-readable diagnostics available for operators.
- Fail closed when a key is missing, expired, revoked, or has an unexpected fingerprint. Do not send an unencrypted fallback merely because encryption failed.
- Ensure the service account can access only the files and key material required for its job.
- Rotate keys according to a documented policy and distribute new public certificates together with independently verified fingerprints.
Troubleshoot common failures
“No public key” or encryption cannot find the recipient
The recipient certificate is absent from the current account’s keyring, or the command selected the wrong identity. Import the recipient’s public certificate, list it with gpg --list-keys, compare the full fingerprint, and use that fingerprint with --recipient.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDecryption asks for a key that is not present
The message was encrypted to a different key, or the recipient’s secret key was not imported into this account. Confirm the recipient fingerprint used by the sender and run gpg --list-secret-keys on the receiving VPS. Do not ask the sender to “encrypt again” until you know which key is actually available.
Signature verification fails
Check that you are verifying the matching file and signature pair, that the signer’s public key is present, and that the transferred files were not altered or truncated. If the cryptographic result is good but the fingerprint is unfamiliar, treat the message as untrusted until the signer’s identity is confirmed independently.
The job hangs waiting for a passphrase
An unattended process is invoking an interactive pinentry program. Rework the job around GPG’s documented batch and status behavior and configure the account’s gpg-agent and pinentry method deliberately. Never solve the hang by placing the passphrase directly in a command line or an unprotected script.
Armored output is rejected by the receiving system
Confirm that the complete armored file, including its header and footer, was transferred unchanged. If the channel accepts binary attachments, generate a binary .gpg file instead. Conversely, do not send binary output through a system documented as text-only.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Production checklist
- Install GnuPG from the VPS distribution and confirm
gpg --version. - Use a dedicated account with restrictive
~/.gnupgpermissions. - Generate or import the required keys and record full fingerprints.
- Save the generated revocation certificate in protected backup storage.
- Verify every recipient public-key fingerprint through an independent channel.
- Encrypt with
--recipient; add--armoronly when the transport needs text. - Sign with
--local-user, or combine--signand--encryptwhen both properties are required. - Decrypt with
--decryptand verify detached signatures with--verify. - Compare reported signer fingerprints, and check expiration and revocation state.
- Keep passphrases out of arguments, history, source, and logs; use an agent for interactive entry and documented status interfaces for automation.
- Back up secret keys and revocation certificates through an encrypted channel, then test restoration in isolation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
