Thunderbird PGP Setup: Encrypt Email Without Add-Ons

If you searched for a Thunderbird PGP setup guide and landed on instructions that start with “install Enigmail,” close that tab. Enigmail has been obsolete since 2020: Thunderbird has shipped its own OpenPGP implementation since version 78, and every current release includes it. This Thunderbird PGP setup guide covers what actually works today: generating a key inside Thunderbird, publishing it so people can find it, exchanging keys with a correspondent, and, most importantly, checking that your first encrypted message really left your machine as ciphertext.

Who this is for (and who it isn’t)

PGP in Thunderbird solves one specific problem: the body and attachments of your email are readable by your mail provider, by anyone who breaches your mail provider, and by anyone your provider hands data to. End-to-end encryption takes all of them out of the loop. Only the person holding the matching private key can read the message. If that public/private split is new, read what PGP encryption is and how it works first and come back.

This is worth doing if you exchange sensitive material with specific people who will also set it up: a source, a lawyer, an accountant, a small team handling client records. It is not worth doing if your goal is hiding who you talk to. As the EFF’s deep dive on public key encryption puts it, intermediaries can still see “who is sending what to whom, what time it’s received, what the subject line is.” Metadata stays visible. If that is your threat model, you want a different tool, not a stronger version of this one.

One more expectation to set: PGP is a two-sided protocol. Until your correspondent finishes their own setup, you have nobody to encrypt to. If they are on Gmail rather than a desktop client, point them at setting up PGP encryption for Gmail.

Step 1: Generate your key pair

You need Thunderbird 78 or newer, which in practice means any version installed in the last several years. No external software: since 78, Thunderbird uses the RNP library as its OpenPGP engine rather than GnuPG. RNP and the surrounding code were audited by Cure53 under the Mozilla Open Source Support program, with no critical or major vulnerabilities found.

The setup path, per Mozilla’s OpenPGP documentation:

1. Open Account Settings for the email account you want to encrypt (right-click the account in the folder pane, or the ≡ menu).
2. Select End-To-End Encryption in the left column.
3. Under OpenPGP, choose Add Key, then Create a new OpenPGP key.
4. Accept the suggested key type unless you have a reason not to, set an expiry date rather than “never” (an expiring key limits the damage if you lose control of it, and you can extend it later), and generate.
5. Back in the End-To-End Encryption panel, confirm the new key is selected for the account.

If you have an existing key from GnuPG or an old Enigmail install, choose Import an existing OpenPGP key instead. Thunderbird’s own OpenPGP HOWTO and FAQ covers the migration cases in detail, and our PGP for email setup walkthrough covers generating and backing up that key pair with GPG in the first place.

Two housekeeping items before you move on. First, set a Primary Password in Settings → Privacy & Security so the secrets stored in your Thunderbird profile are encrypted at rest; your private key now lives in that profile, not in a separate GnuPG keyring. Second, export a backup of your secret key (Account Settings → End-To-End Encryption → OpenPGP Key Manager) with a strong passphrase and store it somewhere offline. If your disk dies and the key dies with it, every message ever encrypted to that key is gone. There is no reset-password flow in cryptography.

Step 2: Publish your public key

People can only encrypt to you if they can get your public key. The clean way is keys.openpgp.org, the successor to the old SKS keyserver network. It behaves differently from the old servers in a way that matters for privacy: anyone can upload key material, but your name and email address only become searchable after you verify the address by clicking a confirmation link. Upload your public key there (you can export it from the OpenPGP Key Manager, or upload from the site), confirm the verification email, and your correspondents can find your key by searching your address.

The low-tech alternative works too: attach your public key to a signed message. Thunderbird can do this automatically per-message from the compose window’s security options.

Step 3: Get and accept your correspondent’s key

Encryption to someone requires their public key on your machine, marked as accepted. When a correspondent emails you their key as an attachment, Thunderbird offers to import it. You can also fetch keys from keys.openpgp.org by email address via the OpenPGP Key Manager’s key discovery.

Before you rely on a key, verify it belongs to the right person. Public key crypto’s classic failure mode is a man-in-the-middle handing you a substitute key, and the defense the EFF recommends is comparing fingerprints: read the key’s fingerprint over a phone or video call, or in person, and check that every character matches what your correspondent sees on their end. For a casual threat model this can feel like ceremony. Do it anyway for anything you would genuinely mind leaking; it takes two minutes.

Step 4: Send, then verify it worked

Compose a message to your correspondent, and in the compose window enable encryption (the OpenPGP/Security dropdown). Sign it as well, so they can verify it came from you. If Thunderbird refuses to enable encryption, it is telling you it has no accepted key for one of the recipients; fix that before assuming the software is broken.

Now verify, because a setup guide that ends at “click send” is how people mail plaintext for months while feeling encrypted:

• Open the message in your Sent folder. Thunderbird should show it decrypted, with an indicator that it was encrypted and signed.
• Log into your provider’s webmail and open the same sent message there. You should see an unreadable block starting with -----BEGIN PGP MESSAGE----- or an encrypted attachment, not your text. Webmail can’t decrypt it; that’s the point.
• Have your correspondent confirm it decrypts on their end and that the signature checks out.

If webmail shows your message in the clear, encryption was not enabled for that send. Recheck step 3.

What this setup does not do

An honest close-out, because PGP guides tend to oversell:

• Metadata is exposed. Sender, recipients, and timing are visible to every server that handles the mail.
• It does not protect a compromised endpoint. If someone can read your unlocked laptop, they can read your decrypted mail.
• It does nothing about phishing or malware, which remain the ways most mailboxes actually get burned. Encryption verifies and conceals content; it does not judge it. Keeping an eye on active credential-theft campaigns is a separate habit; a general security news feed like techsentinel.news helps there.
• Hardware-token users have a caveat. Thunderbird’s RNP engine does not support OpenPGP smartcards; the Thunderbird team documents an advanced configuration that delegates private key operations to a separately installed GnuPG for that case.

None of these are reasons to skip the setup. They are reasons to know what you bought: strong confidentiality for message content between people who both did the ten minutes of work above.

Related across the network

• How to Set Up PGP Email Encryption: A Step-by-Step Guide — privatemailguide.com
• How to Encrypt Email in Gmail: TLS, S/MIME, and End-to-End — privatemailguide.com
• Is Gmail Encrypted? What Google Can Actually Read — privatemailguide.com
• PGP and End-to-End Email Basics: How Encrypted Mail Works — privatemailguide.com
• Best Filament for Beginners: What to Buy First — 3dfilamentguide.com