I'm desparately trying to find an OS X app that can:

  1. generate PGP keys
  2. encrypt files or messages using someone's public key
  3. decrypt files or messages using my private key

However all the tools I've tried so far are either so incredibly user-unfriendly (and poorly documented) that I can't get them to work, or they tend to store all PGP keys somewhere on my system (I think 'keyring' is the correct term).
Or they even install all sorts of email plugins or addons or automatic encryption services. I don't want this. For privacy and security reasons, I don't want to leave any traces behind. And I'm not using this for email.

I just want to have someone's public key, and encrypt a random message with it, or receive an encrypted message from someone else and decrypt that.

Either a GUI or command line app would be fine (preferably something that I can install through brew or brew cask). Any suggestions?

  • You messed something up with public and private keys. You can only decrypt with a private key, a public key on the other hand is used for decryption.
    – Jens Erat
    Jun 22, 2015 at 21:10
  • You must have a public key to which people can encrypt. You must have a private key with which you would send an encrypted message. Both of these actions requires you to have a key, which should probably be stored for a while. You can encrypt and password protect these keys. Look into gpg from the command line. Or, join us on keybase and use the simple-as-heck CLI tool provided.
    – earthmeLon
    Jun 22, 2015 at 21:31
  • @JensErat Thanks, of course, yes I accidentally mixed those up, fixed it.
    – RocketNuts
    Jun 22, 2015 at 23:16

1 Answer 1


I'm not aware of any readily-build software that is able to do this; it might be possible to program such an application using libraries like Bouncy Castle (Java, C#) or the OpenPGP package for Go.

But I can help you with a workaround: GnuPG allows to use a seperate "home directory", and thus also keyring. Doing something like

export GPGHOME=/tmp/gnupg
gpg --import [key-file]
gpg --recipient [key-id] --encrypt <file >output   # or decrypt, of course
rm -r /tmp/gnupg

will simulate what you're looking for. You could also put this together in a small script (consider using gpg --list-packets to grep for the key-id) and use a memdisk to be completely sure not the files are really gone after completion.

  • Thanks, that looks promising. I am able to import a PGP key into a temporary dir and delete that later. Protecting keys with a password is not enough, as gpg --list-keys still shows the identity information. What I don't understand yet, is what is (in gpg's context) a 'user' or a 'uid' or sender or recipient? The help shows, for example: gpg -se -r Bob [file] where Bob is supposed to be a 'user', but what does that mean? I would assume I need to specify the receiver's public key (to encrypt the message), and optionally my own private key to sign it?
    – RocketNuts
    Jun 22, 2015 at 23:50
  • GnuPG's manual discusses possibilities to specify user IDs extensively.
    – Jens Erat
    Jun 23, 2015 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.