How to Encrypt Email in Outlook with Gpg4win and OpenPGP

This guide shows you how to send and receive OpenPGP end-to-end encrypted email in Microsoft Outlook on Windows using Gpg4win, the free, official GnuPG distribution for Windows. You will install Gpg4win, create your personal key pair in its Kleopatra key manager, back the secret key up safely, exchange public keys with the people you write to, and then sign and encrypt messages directly in Outlook. Encrypted mail sent this way is unreadable to every server that carries or stores it, including the Noiz mail servers; it is decrypted only on your correspondent’s own device. If you are new to the ideas behind OpenPGP, read Why and How to Encrypt Your Email with OpenPGP first.

Last reviewed: 3 August 2026, against Gpg4win 5.1.0 (the current release on the vendor’s download page, dated 29 July 2026), which bundles GnuPG 2.5.21, Kleopatra 5.1.0 and the GpgOL Outlook add-in 2.7.3. This guide is written for Noiz hosting and is kept current against Gpg4win. It complements, and does not replace, the official Gpg4win documentation linked below.

Official Documentation Reference

• Gpg4win.org: the official home of Gpg4win, with the download, system requirements and documentation.
• Gpg4win download page: always the current installer; Gpg4win is free software under the GNU GPL, for commercial use too, and the donation step on the download page is optional.
• Gpg4win Compendium: the vendor’s full manual for the suite. Its concepts remain the reference, though its screenshots date from older versions.
• OpenPGP.org: the standard itself, and the wider ecosystem of compatible software.

Before Anything Else: Classic Outlook, Not “New Outlook”

This is the single most important compatibility fact, and it catches people constantly. Gpg4win integrates with Outlook through GpgOL, which is a COM add-in. Microsoft’s own documentation states plainly that COM add-ins are not supported in the “new Outlook for Windows”, the client with the toggle that Windows has been steering users towards. GpgOL therefore works in classic desktop Outlook only. The vendor lists classic Outlook 2021, 2024 and Microsoft 365 as supported, with older versions back to 2010 likely to work but out of support.

What this means in practice:

• If you use classic Outlook, continue with this guide; everything below applies to you.
• If you use new Outlook, GpgOL cannot load there. Microsoft supports returning to the classic client; do that first, then follow this guide. Be aware that a Windows or Office update that silently moves you to new Outlook will take your encryption integration with it, so if encrypted mail matters to you, treat “which Outlook am I in” as something to check after major updates.
• The Gpg4win project does ship an experimental web add-in for new Outlook, called GpgOL/Web, but the vendor itself labels it experimental with possible disruptive changes. It is not covered here and is not something to rely on for real correspondence yet.
• Whatever Outlook does, Kleopatra keeps working: you can always encrypt or decrypt text and files in Kleopatra directly and paste the result anywhere, which makes a serviceable fallback in any mail client.

If Outlook is not a requirement for you, Thunderbird has OpenPGP built in with none of these constraints.

Prerequisites

• A Windows 10 (version 1809 or later) or Windows 11 PC, 64-bit. Gpg4win 5.x no longer supports 32-bit Windows.
• Classic desktop Outlook, with your Noiz email account already set up over IMAP (a Noiz mailbox is IMAP; GpgOL also supports Exchange accounts from other providers). The vendor does not support POP3 accounts with GpgOL, and they are known to cause decryption problems, so check your account type first.
• A few minutes, and somewhere genuinely safe and offline (an encrypted USB stick, or a password manager’s secure file store) for your key backup.

Step 1: Install Gpg4win

1. Download the installer from the official download page only. It is free; the donation prompt can be skipped.
2. Close Outlook if it is running.
3. Run the installer. When it asks which components to install, keep at least Kleopatra (the key manager), GpgOL (the Outlook add-in) and GpgEX (right-click file encryption in Explorer).
4. Start Outlook again afterwards so it picks up the add-in.

Step 2: Create Your Key Pair in Kleopatra

Kleopatra is where your keys live; Outlook only uses them.

1. Open Kleopatra from the Start menu.
2. Choose File, then New OpenPGP Key Pair.
3. Enter your name and the email address of your Noiz mailbox, exactly as you send from it.
4. Tick the option to protect the key with a passphrase, and choose a strong one you can remember. This passphrase is what stands between anyone at your unlocked PC and your mail.
5. Accept the default key settings unless you have a specific reason not to; the defaults are modern and interoperable.
6. Click through to generate the key. When it completes, your new certificate appears in Kleopatra’s list.

Back up your secret key now

A failed disk or a reinstalled Windows takes your secret key with it, and with it every message ever encrypted to you. In Kleopatra, select your new certificate, then choose File, then Backup Secret Keys; save the file and move it somewhere safe and offline. Keep the passphrase in your password manager. Do this before you send a single encrypted message.

Step 3: Exchange Public Keys

Encryption runs on public keys: people encrypt to you with your public key, and you encrypt to them with theirs.

• Give people your public key. In Kleopatra, right-click your certificate and choose Export, which saves a small .asc file that is safe to share with anyone by any means. You can also publish it to the keys.openpgp.org directory, which verifies your address by email before serving your key to others.
• Import the keys of people you write to. When someone sends you their .asc public key file, import it via Kleopatra (File, then Import), or use Kleopatra’s Lookup on Server search to find keys published on keyservers.
• Verify before you trust. The fingerprint of a key is its true identity. For correspondence that matters, compare the fingerprint with the owner over another channel (a phone call is fine) before certifying the key in Kleopatra. This is what stops an impostor slipping you a key that is not really theirs.

Step 4: Send Encrypted and Signed Mail in Outlook

With GpgOL loaded, classic Outlook’s compose window gains OpenPGP controls: GpgOL adds Sign and Encrypt controls to the ribbon of a new message.

1. Start a new message to a correspondent whose public key you have imported.
2. Enable Encrypt, and optionally Sign so they can verify the message really came from you.
3. Send. GpgOL encrypts the body and attachments before the message leaves your machine; if it has no usable key for a recipient, it tells you rather than sending readable mail by mistake.
4. Received encrypted mail decrypts when you open it, after you enter your key passphrase (the passphrase prompt comes from GnuPG, not Outlook, and remembers your entry for a while).

Two behavioural notes worth knowing. The message subject is not encrypted, so keep anything sensitive out of it. And your own Sent copy is encrypted too, so losing your key means losing your sent encrypted mail as well; that is what the backup in Step 2 protects.

Troubleshooting

• Symptom: no OpenPGP or Secure controls appear when composing: you are either in new Outlook (see the section above; GpgOL cannot load there) or the add-in did not register. Confirm you are in classic Outlook, then reinstall Gpg4win with Outlook fully closed and start Outlook again.
• Symptom: mail on a POP3 account decrypts oddly, repeatedly, or not at all: POP3 is unsupported by GpgOL. Switch the account to IMAP; on a Noiz mailbox that is a settings change, and the Noiz support team can confirm the server settings.
• Symptom: Outlook’s own “Encrypt” or S/MIME features fight with GpgOL: use one system, not both. If you are committed to OpenPGP, leave Outlook’s native S/MIME encryption unconfigured; GpgOL handling both protocols alongside Outlook’s own S/MIME is a known source of confusion.
• Symptom: sending fails for one recipient with a key error: you have no usable, certified public key for that address. Import or look up their key in Kleopatra, check its fingerprint, and try again.
• Symptom: you replaced your PC and encrypted mail is unreadable: restore your secret key backup in Kleopatra (File, then Import, then select your backup file and enter its passphrase). Without the backup file, the mail cannot be recovered by anyone, Noiz included.

OpenPGP in Outlook has more moving parts than in Thunderbird, but once the key pair exists and the right Outlook is in use, day-to-day encrypted mail is a matter of two ribbon toggles. If you hit trouble on the mailbox side, open a support ticket with the Noiz support team and describe what you see; the team can verify your account and server settings up to the point the encryption takes over, though nobody at Noiz can ever read the encrypted messages themselves, which is rather the point.