Thunderbird PGP Encryption Setup (2026): OpenPGP, Step by Step

Most “encrypted email” guides assume you’ll install something. Thunderbird hasn’t needed an add-on for this in years — OpenPGP has been baked into the client since version 78, and the old Enigmail extension was retired the moment it landed. I generated a fresh key pair in Thunderbird 152 while writing this, exchanged public keys with a second account, and sent a message whose body was genuinely unreadable to anything but the recipient’s key. The setup takes about ten minutes if you do it in the right order — and the wrong order is exactly where people get stuck. Here is the sequence that works.

Built In, No Add-On

Thunderbird has shipped OpenPGP natively since version 78, enabled by default since 78.2.1. There is no Enigmail to install — that add-on was retired and only kept available to migrate former users. On the current monthly Release (Thunderbird 152) or the 115 ESR, you configure PGP entirely from Account Settings.

If you last touched PGP in the Enigmail era, forget the plugin step. Per Mozilla’s Thunderbird support, Thunderbird 78 introduced built-in support for two encryption standards, OpenPGP and S/MIME, and OpenPGP has been enabled by default since version 78.2.1. The Enigmail add-on is no longer available for Thunderbird 78 except to assist its former users with migrating.

That matters for a 2026 setup because every screen you need now lives inside the client. The current stable build is Thunderbird 152 on the monthly Release channel, with a 115 ESR for people who prefer annual feature updates — and the OpenPGP workflow is identical across both. Everything happens in two places: the End-to-End Encryption panel in Account Settings, where your own key lives, and the OpenPGP Key Manager in the Tools menu, where everyone else’s keys live. Get those two oriented and the rest is mechanical. If you are arriving fresh, the walkthrough for migrating into Thunderbird covers getting your accounts in before you layer encryption on top.

Step 1: Your Key

Open the menu (≡), choose Account Settings, select your account, and click End-to-End Encryption, then Add Key. Create a new OpenPGP key for that address. Thunderbird generates a key pair — a public key you give out and a secret key you must never share — and sets it as your personal key.

Start with yourself. You cannot send or receive anything encrypted until your identity has a key.

1. Open Account Settings. Click the menu (≡), choose Account Settings, then select the email account you want to protect in the left column.
2. Open End-to-End Encryption. Click the End-to-End Encryption entry for that account. This panel holds your personal OpenPGP key.
3. Click Add Key. Choose to create a new OpenPGP key, or import an existing key file if you already have one from another machine.

When you create, Thunderbird generates the key pair for you. The mechanics are worth understanding once: per Mozilla’s introduction to end-to-end encryption, a message is encrypted using the public key and can be decrypted only by the person holding the matching secret key — and you must never share the secret key with anyone else. Set an expiry, confirm, and the key becomes the personal key bound to that identity. That single step is the foundation everything else stands on.

Step 2: Exchange Keys

Open the OpenPGP Key Manager from the Tools menu. Use File to export your public key and send it to your contact. Import theirs by accepting the prompt when they attach a key, pasting from the clipboard via Edit, or clicking their address and choosing Discover Keys, which searches the WKD protocol and the keys.openpgp.org keyserver.

Encryption is a two-party agreement. Each side needs the other’s public key, and the OpenPGP Key Manager — found in the global Tools menu — is where that exchange happens.

To hand out yours: select your key, open File, and export the public key. It is safe to share freely; that is the whole point of a public key. Send that file to your contact, or publish it.

To bring in theirs, Thunderbird gives you three routes, per Mozilla’s support:

• From an attachment. When a correspondent emails you their public key, Thunderbird offers to import it — accept the offer.
• From the clipboard. Paste a key block in via the Key Manager’s Edit menu.
• By discovery. Click an email address in a message and choose Discover Keys. Thunderbird searches the WKD protocol and the keys.openpgp.org keyserver — it deliberately avoids the old non-verifying keyservers that caused security problems.

That last route is the quiet upgrade in modern Thunderbird: for contacts whose providers publish keys, you often get theirs without a single attachment changing hands.

Step 3: Accept and Send

In the Key Manager, select your contact’s imported key and set its acceptance — accepting means you are willing to use it to encrypt to that person. Then compose, open the Security button’s menu, enable Require Encryption and Digital Signature, and send. Encryption stays unavailable until a recipient’s key is accepted.

This is the step people skip, then wonder why the encrypt option is greyed out. Importing a key is not the same as trusting it. In the Key Manager, select your contact’s key and set its acceptance: per Mozilla, if you accept a key, it means you are willing to use that key for sending encrypted messages to that correspondent. No acceptance, no encryption.

Once accepted, compose a message to that address. In the compose window, open the Options menu or the menu on the Security button and enable Require Encryption and, ideally, Digital Signature. Send it. The body is now ciphertext to anyone intercepting it; only the recipient’s secret key can open it.

A practical note on order: signing works the instant you have your own key, but encryption waits on the recipient’s accepted key. So the very first encrypted message in any new relationship always lags one key exchange behind. Plan for it rather than fighting it. If you are hardening one address, it pairs well with a tighter Thunderbird spam filter setup so the inbox you’ve just secured stays clean too.

Signing vs Encrypting

Signing proves a message came from you unaltered, using your secret key and needing nothing from the recipient. Encrypting hides the body from everyone but the recipient, using their accepted public key. They are independent — you can do either, neither, or both — and for private mail, both is the right default.

The two protections get conflated constantly, and the difference is the difference between authenticity and secrecy.

A digital signature answers “is this really from them, and was it tampered with?” It is built from your secret key, so the recipient verifies it against your public key. Mozilla puts it plainly: a signature confirms sender identity. Crucially, signing needs nothing from the other party — which is why you can sign every outgoing message immediately, long before you have anyone’s encryption key.

Encryption answers a different question: “can anyone but the recipient read this?” It uses the recipient’s public key, so only their secret key decrypts it. That is the half that depends on key exchange and acceptance.

For genuinely private correspondence, enable both. The signature lets the recipient trust the sender; the encryption stops everyone else from reading along. Treating them as one switch is the most common conceptual mistake newcomers make — and it is why the encrypt button can sit there inactive while signing already works.

What PGP Does Not Hide

PGP encrypts the message body, not everything around it. The subject line can remain readable even with end-to-end encryption on, metadata like sender, recipient, and timing stays exposed, and a lost secret key means lost access to past messages forever. Knowing these limits keeps PGP from becoming false comfort.

Encryption is powerful and narrow at the same time. Three boundaries decide whether your setup is actually safe:

• The subject line leaks. Mozilla’s documentation is explicit: the subject of the mail may remain unprotected and easily readable, even when end-to-end encryption is used. Thunderbird 91 and later let you control encrypted subjects, but you should never count on it — keep names, amounts, and context out of the subject and inside the encrypted body.
• Metadata is not content. PGP hides the body, not the envelope. Who emailed whom, when, and how often remains visible to anyone watching the traffic. If the relationship itself is sensitive, encryption alone does not cover you.
• A lost secret key is unrecoverable. Public keys re-share freely; the secret key does not. Lose it and every message ever encrypted to you becomes permanently unreadable. Back it up — in the Key Manager, File → Backup Secret Key — and store it offline.

These limits are why some people prefer providers that fold metadata-aware design and automatic encryption into one package; the trade-off is examined in the Tutanota pricing breakdown. For self-managed PGP in Thunderbird, the rule is simple: encrypt the body, never trust the subject, and guard the secret key like the irreplaceable thing it is.

Verdict

Thunderbird PGP encryption in 2026 is built in, free, and standards-based — no add-on, configured from Account Settings and the Key Manager. Done in order — your key, then key exchange, then acceptance — it sends genuinely encrypted, signed mail in about ten minutes. The catch is the subject line and metadata, which stay exposed.

Best for: anyone who wants real, vendor-independent end-to-end encryption and is willing to manage keys themselves. The payoff is control — your secret key never leaves your machine, the encryption is open OpenPGP rather than a proprietary box, and it works with any correspondent who publishes a key. For developers and privacy-minded users already living in a desktop client, it slots straight into the workflow; the best email clients for developers roundup explains why Thunderbird keeps earning that spot.

Skip if: you need encryption to be invisible and effortless across a whole team, or you cannot reliably back up and protect a secret key. Manual PGP rewards diligence and punishes carelessness — a lost key locks you out for good. If that risk outweighs the control, a managed encrypted provider is the saner choice.

Set up your key now, exchange with one contact, and send a single encrypted test message. Once you have watched a body turn unreadable and then open cleanly on the other side, the whole model clicks — and the ten-minute setup becomes a habit you reach for whenever a message genuinely needs to stay private.

Alexis Dollé

Founder & Editor

Alexis Dollé, email expert for 10+ years. Founder of Email Tools. I test every email client and utility myself, then write about them the way I’d explain them to a friend — no marketing fluff, no sponsored rankings, every claim sourced.

LinkedIn

Related: Migrate to Thunderbird — get your accounts in before layering on encryption. Thunderbird spam filter setup — keep the secured inbox clean. ProtonMail Bridge setup — encryption without manual key management. Best email clients for developers — why Thunderbird keeps earning the spot.