---
title: OpenPGP Encryption
description: How to setup PGP encryption in CProof
sidebar:
  order: 3
  label: OpenPGP
---

## Assigning a key to your account

To allow contacts to send you PGP encrypted messages you must have a PGP key assigned to your account. To list all available keys on your system, use the command _/pgp keys_

![CProof pgpkeys](@assets/pgpkeys.png)

Set the account _pgpkeyid_ property with the [`/account`](/command-reference#account) command.

```bash
/account set alice@ejabberd.local pgpkeyid B4510EE476F2AA6F
```

## Assigning keys to contacts

To be able to send PGP encrypted messages to contacts, you must associate a public key with them. The <a href="http://www.xmpp.org/extensions/xep-0027.html#signing" target="_blank" rel="noopener noreferrer">specification</a> states that contacts should sign their presence with their key, if your contacts do this, you need to do nothing else.

If your contacts do not sign their presence, you will need to manually assign a public key using the _/pgp setkey_ command.

```bash
/pgp setkey eddie@ironmaiden.com C4C71F21D0F2EC3D
```

To view a list of all currently known public keys, either through received signed presence or set manually.

```bash
/pgp contacts
```

![CProof contacts](@assets/contacts.png)

## Sending PGP encrypted messages

To start a new conversation sending PGP encrypted messages to a contact:

```bash
/pgp start bob@ejabberd.local
```

If you are already in a conversation window without PGP, you can start sending encrypted messages with the same command omitting the contact:

```bash
/pgp start
```

![CProof sending](@assets/sending.png)

## Receiving PGP encrypted messages

Assuming a public key is associated with the contact, they must also have enabled PGP encryption at their end.

![CProof sending](@assets/receiving.png)

## Ending PGP encryption

To stop sending PGP encrypted messages to a contact:

```bash
/pgp end
```

![CProof endingsend](@assets/endingsend.png)

The contact may also end PGP encryption at their end at any time.

![CProof endingrecv](@assets/endingrecv.png)

## User Interface options

By default, an indicator is displayed in the titlebar when no encryption is being used (including [OTR](/guides/otr-message-encryption) and [OMEMO](/guides/omemo-encryption)).

![CProof encwarn](@assets/encwarn-2.png)

This indicator can be removed using the [/encwarn](/command-reference#encwarn) command.

```bash
/encwarn off
```

![CProof encwarnoff](@assets/encwarnoff-2.png)

Both incoming and outgoing plaintext messages are always preceded by the '-' character.

![CProof plainchar](@assets/plainchar-2.png)

By default PGP encrypted messages are preceded by the '~' character.

![CProof pgpchar](@assets/pgpchar.png)

This character can be changed using the _/pgp char_ command.

```bash
/pgp char P
```

![CProof newchar](@assets/newchar-2.png)

## PGP message logging

The _/pgp log_ command may be used with the following options to control if and how PGP messages are recorded in chat logs.

|        |                                                                                           |
| ------ | ----------------------------------------------------------------------------------------- |
| on     | PGP messages will be logged in plaintext.                                                 |
| redact | PGP messages will be logged, but the message will be replaced with the text '[redacted]'. |
| off    | PGP messages will not be logged.                                                          |

For the _on_ and _redact_ settings, chat logging must also be enabled with the [/chlog](/command-reference#chlog) command.
