I work with PGP regularly and I work with it across multiple operating systems. Linux on my workstation, a MacBook on the go and every now and then I have to touch Windows. And on every single one of them, PGP means a different tool: Kleopatra on Linux, GPG Keychain on Mac, Gpg4win on Windows (which is Kleopatra again, just wrapped differently). Three tools, three UIs, three sets of quirks, three different workflows and none of them are what I'd call user-friendly.
And yes, i know: the GnuPG CLI is the same everywhere, and it's a great tool. I use it. But gpg --encrypt --sign --armor -r test@key.com is not something I want to type 100 times a day and it's definitely not something I can give to a non-technical colleague. Every time I had to walk someone through encrypting or decrypting a message, I lost a bit of hope.
So I made it my mission to finally build something better: PGP Manager. A free and open-source desktop app that looks and works the same on Linux, Mac and Windows.
Why another PGP Tool?
The cryptography behind OpenPGP is mature and has been trusted for decades. The problem was never the crypto, it's the workflow and the fragmentation. Encrypting a message for a colleague shouldn't require different tools per OS and a wiki page.
My goal was simple: all the everyday PGP tasks in one place, without dumbing anything down or inventing a new format. PGP Manager is not a new crypto system. It uses gopenpgp v3 (ProtonMail's OpenPGP library) and standard OpenPGP (RFC 4880), so it stays fully compatible with GPG, Kleopatra, Thunderbird and the rest. You can leave anytime, your keys are just standard armored files.
One more thing that sets it apart from the tools above: they're all frontends for a local GnuPG installation. PGP Manager brings its own OpenPGP implementation, so there's nothing else to install. It can still read an existing GnuPG keyring if you have one, but it doesn't need it. That's also what makes the standalone/USB mode possible in the first place.
What it does
The basics you'd expect:
- create and manage keys and multiple identities incl. subkeys
- encrypt/decrypt text and files, for one or multiple recipients
- sign and verify messages and files
- search public keyservers and import keys with one click
And the parts I'm actually proud of:
Clipboard Auto-Detect
Copy an encrypted message, and the app opens and starts decrypting, if you have a matching private key. Copy a public key, and you get an import dialog. Copy a signed message, and it gets verified silently in the background, with a notification telling you if the signature is valid. Everything configurable, of course.
(And before anyone asks: no, it doesn't continuously read your clipboard. It polls a cheap change counter the OS provides, and only reads the actual contents when that counter changes. You can also turn the whole thing off.)
System Tray
PGP Manager can live entirely in the tray, always one click away. The menu is context-sensitive and only shows what makes sense for your current clipboard: plain text gets Encrypt/Sign, an encrypted message gets Decrypt, a key block gets Import.
Standalone Mode
Keep the app, your keys and config in one folder, e.g. on a USB stick. Useful for multiple profiles, isolated environments or temporary workstations.
MacOS Services
Select text in any app or files in Finder, right-click, and encrypt/decrypt/sign/verify directly from the Services menu. No need for the clipboard at all.
Passphrase Cache
The matching private key is identified from the message's PKESK headers instead of trying every key, and unlocked passphrases stay in memory for a configurable time. So you type your passphrase once per session, not once per message.
Use Cases
A few scenarios where this already saves me time daily:
- Encrypted Messages over insecure channels. Someone sends you a PGP message via email, Slack, Discord, whatever. Copy it, the app decrypts it. Reply, encrypt, done. No copy-pasting into terminal commands.
- Sending credentials to clients or colleagues. Grab their public key from a keyserver, encrypt the file, send it. The whole flow takes seconds.
- Verifying software releases. Copy the signed message or signature, get a notification whether it's valid and who signed it.
- Portable setup. Your keys on a USB stick, usable on any machine without installing or configuring anything.
- Onboarding non-technical people. This was honestly the main driver. You can now tell someone "install this, click create key, send me the public key" and it actually works.
The stack, for the curious
Go + Wails v2 (not Electron: Wails uses the OS's native webview, so no bundled Chromium and the binaries stay small), with a Svelte + Tailwind frontend. Crypto via gopenpgp v3, keys stored as standard armored files.
Everything runs locally - no accounts, no telemetry, no cloud. Internet is only used for keyserver lookups, and only if you use them. Your keys stay under your control.
Building a tray app that behaves natively on three platforms was its own adventure (macOS NSStatusItem and Services integration, Windows registry autostart, XDG on Linux), maybe worth its own post if there's interest.
Try It
Grab the latest release for your platform here: Github Latest Release
Mac gets a .dmg, Windows a single .exe, Linux a plain binary. No installer needed, it also runs straight from a folder or USB stick.
What it doesn't do (yet)
No smartcard/YubiKey support, no email client integration (use it alongside Thunderbird, not instead of it), and there's been no formal third party security audit. The crypto itself is handled entirely by gopenpgp, which is maintained by Proton and widely used, but if you want to dig through my code, please do. The project is young, so expect some rough edges.
Feedback welcome
If you try it, I'd love to hear what works and what doesn't. And an honest question to the PGP users here: what's the one feature that would make you switch from your current setup?
Issues, feedback and contributions are all more than welcome.