Skip to content
Noiz Knowledgebase

Why and How to Encrypt Your Email with OpenPGP

Email feels private, but it is closer to a postcard than a sealed letter. This article explains what actually happens to a normal email, why that matters more in the age of AI than it ever has, and how OpenPGP end-to-end encryption puts the contents of your mail beyond the reach of every server that handles it, including the servers of Noiz. It then points you to the right step-by-step guide for the mail software you use: Thunderbird, Outlook on Windows, or webmail in your browser.

Last reviewed: 3 August 2026. The concepts here do not change with software versions; each linked guide carries its own version notes for the tool it covers.

Official Documentation Reference

Section titled “Official Documentation Reference”

What Actually Happens to a Normal Email

Section titled “What Actually Happens to a Normal Email”

When you send an ordinary email, the connection between your mail app and the server is encrypted with SSL/TLS, and so, usually, is the connection between servers. That protects the message in transit. But at every stop along the way, the message itself is processed and stored in plain text: on your provider’s server, on the recipient’s provider’s server, and in both mailboxes, often for years.

Anything that can read those servers can read that mail. That includes the provider’s software, its staff under whatever policies apply, anyone who compromises the server, and any authority that can compel access. And increasingly it includes AI. Large mail providers analyse message content to power features such as smart replies, search, categorisation and AI assistants, and those features only work because the content is readable to the provider’s software. None of this requires anyone to “hack” anything: unencrypted mail at rest is simply readable, and always has been.

Noiz does not read or mine customer mailboxes; the only automated processing is spam and virus filtering at delivery. But honesty requires the stronger statement: on any standard mail platform, including one hosted by Noiz, the operator could technically read stored mail, because the mail is stored readable. If that is not acceptable for a given conversation, the answer is not a different provider promise. The answer is encryption that no provider can undo.

What OpenPGP Does, and What It Does Not

Section titled “What OpenPGP Does, and What It Does Not”

OpenPGP is the open standard for end-to-end email encryption, implemented by Thunderbird, GnuPG, Gpg4win, Mailvelope and many other tools. Your message is encrypted on your own device before it is sent and decrypted only on the recipient’s device. Every server in between, Noiz’s included, carries and stores only unreadable ciphertext.

It works with a matched pair of keys. Your public key is shared freely; anyone can use it to encrypt mail that only you can read, and to verify your digital signature. Your secret key never leaves your control and is the only thing that can decrypt mail sent to you. Alongside encryption, OpenPGP gives you digital signatures, which prove a message genuinely came from you and was not altered on the way.

Be equally clear about the limits:

  • The subject line and metadata are not encrypted. Who wrote to whom, when, and under what subject remains visible. OpenPGP protects the message body and attachments.
  • Both sides need OpenPGP. You cannot send encrypted mail to someone who has no key. Signatures are the exception: you can sign mail to anyone.
  • Lost keys are unrecoverable. There is no password reset. A lost secret key with no backup means every message encrypted to it is gone for good, and not even Noiz can get it back. Every guide below therefore treats the key backup step as non-negotiable.
  • Spam filtering cannot see inside. Encrypted content passes through content filters unread, and webmail search cannot index it. That is the feature doing its job.

Pick the Guide for Your Mail App

Section titled “Pick the Guide for Your Mail App”

All of these tools implement the same OpenPGP standard, so they interoperate: a key pair created in one works with mail encrypted in another, and your correspondents can use whichever tool suits them.

A Realistic Way to Start

Section titled “A Realistic Way to Start”

Do not try to encrypt everything on day one; almost nobody you write to has a key yet, and OpenPGP only works when both sides use it. The pattern that works:

  1. Set up your key pair with the guide for your mail app, and back up your secret key immediately.
  2. Turn on signing for your everyday mail if you wish; it works regardless of what your recipients use and lets them verify you.
  3. Publish your public key to keys.openpgp.org so people can find it, and exchange keys deliberately with the handful of people you genuinely need private correspondence with: your accountant, your lawyer, your co-directors.
  4. Encrypt the conversations that warrant it, and let the habit spread from there.

Transport encryption (SSL/TLS) on your mailbox connections is already in place on Noiz hosting and needs nothing from you. OpenPGP is the layer only you can add, because its entire point is that the keys belong to you and not to your provider. If you get stuck setting it up on a Noiz mailbox, open a support ticket with the Noiz support team; the team can check everything up to the point the encryption takes over.