Skip to content
Noiz Knowledgebase

How to Use OpenPGP Encryption on Android with Thunderbird

This guide shows you how to read and send OpenPGP encrypted email on an Android phone or tablet using Thunderbird for Android. Encryption on mobile works differently from the desktop: Thunderbird for Android does not carry its own OpenPGP engine, it hands the cryptography to a separate OpenPGP app that holds your keys. You will install that app, move your existing key onto the phone safely, connect the two, and then send and read encrypted mail on your Noiz mailbox. If the ideas behind OpenPGP are new to you, start with Why and How to Encrypt Your Email with OpenPGP.

Last reviewed: 3 August 2026, against Thunderbird for Android 21 and OpenKeychain 6.0.4. The steps and screen labels here were taken from the vendor’s released sources rather than from a specific handset, so the exact position of a setting can vary with your Android version and phone. This guide is written for Noiz hosting and is kept current against Thunderbird. It complements, and does not replace, the official Thunderbird documentation linked below.

Official Documentation Reference

Section titled “Official Documentation Reference”

Prerequisites

Section titled “Prerequisites”
  • An Android device. Thunderbird’s released mobile app is Android only; the iOS version is still in development and not published, so this guide does not cover iPhone or iPad.
  • Thunderbird for Android installed, from Google Play or F-Droid, with your Noiz mailbox already added. If the account is not set up yet, the settings are the same ones in How to Set Up Email on Android.
  • An OpenPGP key you already own, ideally created on the desktop by following How to Set Up OpenPGP Encryption Keys in Thunderbird, along with the passphrase for its backup file. Creating your key on the desktop first is the easier order: it is where the key manager and backup tools are.

How Encryption Works on Android

Section titled “How Encryption Works on Android”

On the desktop, OpenPGP is built into Thunderbird. On Android it is deliberately split in two:

  • Thunderbird for Android handles your mail, and asks another app to do the cryptography.
  • An OpenPGP provider app stores your keys and performs the signing, verification, encryption and decryption. The app this guide uses is OpenKeychain, which is what Thunderbird’s OpenPGP integration is written against.

The practical consequence is that your secret key lives in OpenKeychain, not in Thunderbird, and Thunderbird asks it to work on each message. It also means both apps must be installed, and that removing the OpenPGP app takes your ability to read encrypted mail with it.

One honest note on OpenKeychain before you install it. It is open source and it works, but its public development has been quiet since 2024, and the Thunderbird project has an open discussion about eventually replacing this dependency with a built-in library. Nothing is broken today, and it remains the documented route to OpenPGP on Thunderbird for Android, but it is worth knowing you are relying on an app that is not under active development, and worth re-checking this guide before you depend on it heavily.

Step 1: Install the OpenPGP App

Section titled “Step 1: Install the OpenPGP App”

Install OpenKeychain on the phone from wherever you get your Android apps, Google Play or F-Droid. It is free and open source.

Open it once after installing so it can finish setting itself up. You do not need to create a key in it: you are going to bring across the key you already have.

Step 2: Get Your Key onto the Phone Safely

Section titled “Step 2: Get Your Key onto the Phone Safely”

Your secret key needs to move from your computer to the phone, and how you move it matters more than any other step in this guide. Anyone who gets both the file and its passphrase can read your encrypted mail and sign messages as you.

  1. On the desktop, open Thunderbird’s OpenPGP Key Manager, select your own key, and use File, then Backup Secret Key(s) To File. Set a strong password on the backup when prompted. This produces an .asc file.
  2. Move that file to the phone by a route that does not leave copies behind: a USB cable is the safest. Do not email it to yourself, and do not put it in a cloud drive or a chat app, because the whole point of the exercise is that no service ends up holding your secret key.
  3. On the phone, open OpenKeychain, choose to import a key from a file, and select the .asc file. Enter the backup password you set in step 1 when asked.
  4. Delete the .asc file from the phone’s storage once the import has succeeded. The key now lives inside OpenKeychain; the loose file is just an unprotected copy waiting to be found.

Before you go further, make sure the phone itself is protected: a screen lock (PIN, password or biometric) and device encryption, which is standard on current Android versions. A key on an unlocked phone is a key anyone who picks it up can use.

Step 3: Switch On Encryption in Thunderbird

Section titled “Step 3: Switch On Encryption in Thunderbird”

With the key on the phone, connect Thunderbird to it.

  1. Open Thunderbird for Android and go into Settings, then your Noiz account’s settings.
  2. Open the End-to-end encryption section.
  3. Turn on Enable OpenPGP support. If you have more than one OpenPGP app installed, Select OpenPGP app and choose OpenKeychain.
  4. Tap Configure end-to-end key and pick the key you imported in Step 2.

If the section reports No OpenPGP app configured, the provider app was not found: check OpenKeychain is installed and open it once, then come back.

Step 4: Read and Send Encrypted Mail

Section titled “Step 4: Read and Send Encrypted Mail”

Reading needs nothing from you. When an encrypted or signed message arrives, Thunderbird passes it to OpenKeychain, which decrypts it with your key and checks any signature. You will be asked for your key passphrase, and the message then displays normally with its signature status shown.

Sending is chosen per message in the compose screen. Turn encryption on for a message and Thunderbird encrypts it with the recipient’s public key, which you must already hold in OpenKeychain, exactly as on the desktop. You can also sign without encrypting, which proves the message came from you but leaves it readable; the app explains this as PGP Sign-Only Mode when you choose it.

Two things the app will warn you about, worth understanding before you meet them:

  • PGP/INLINE mode is an older, more compatible message format. The app is explicit that in this mode attachments are not supported and signatures may break in transit. Leave it off unless a specific correspondent needs it.
  • Sign-only messages are not private. Signatures can also break when sent through mailing lists, and some mail clients show the signature as a signature.asc attachment rather than a tidy badge.

Encrypted messages always include a signature, so you do not need to enable both for a private message to also prove it came from you.

What This Does and Does Not Change

Section titled “What This Does and Does Not Change”

Your Noiz mailbox needs no changes for any of this. Encryption happens on the phone before the message is sent, and the Noiz mail servers carry the same unreadable ciphertext they carry from your desktop. The limits of OpenPGP are the same on mobile as anywhere else: the subject line and the message headers are not encrypted, both sides need OpenPGP, and a lost key with no backup means permanently unreadable mail. Server-side spam filtering and webmail search cannot see inside encrypted messages either, which is the feature working as intended.

Adding a phone does add one genuinely new risk worth weighing: your secret key now exists in one more place, on a device that is easier to lose than a computer. If a phone goes missing, treat the key on it as exposed, and use your desktop key manager to revoke the key and tell your correspondents.

Troubleshooting

Section titled “Troubleshooting”
  • Symptom: the End-to-end encryption settings say No OpenPGP app configured: OpenKeychain is not installed, or has never been opened. Install it, open it once, then return to the account’s encryption settings.
  • Symptom: Missing OpenPGP app - was it uninstalled?: the provider app Thunderbird was configured against is gone. Reinstall OpenKeychain and select it again under Select OpenPGP app.
  • Symptom: you cannot pick a key under Configure end-to-end key: OpenKeychain holds no secret key for that address yet. Import your key backup as in Step 2, and check the key’s address matches the account’s address.
  • Symptom: an encrypted message will not open: it was encrypted to a key you do not have on this phone, or the import did not include the secret half. Re-import from the backup file, which contains the secret key, rather than from a public key you exported.
  • Symptom: you cannot encrypt to a particular person: you do not hold their public key in OpenKeychain. Import it there, the same way you would accept a key on the desktop.
  • Symptom: attachments vanish from encrypted messages: PGP/INLINE mode is switched on, and it cannot carry attachments. Turn it off so messages are sent in the standard format.

Encrypted mail on a phone is worth the setup if you need to read private correspondence away from your desk, but do the key work on the desktop first and move a backup across deliberately. If you get stuck on the mailbox side of things, open a support ticket with the Noiz support team; the team can confirm your Noiz account and its settings are correct, though by design nobody at Noiz can read your encrypted messages or recover your key.