Encrypt email with GPG keys in cPanel (Encryption tool)

Normal email is encrypted while travelling between servers (TLS), but it is stored readable in every mailbox it reaches. For truly confidential messages, such as contracts, passwords or health data, end-to-end encryption with OpenPGP makes a message readable only by the recipient's private key. cPanel's Encryption tool manages GnuPG keys for your account.

Before you start

• The recipient must also use OpenPGP and send you their public key. Encryption only works when both sides take part.
• Decide where your private key lives. Keys created in cPanel are stored on the server; keys created in Thunderbird or a desktop tool stay on your computer, which is more private.

Generate a key in cPanel

1. Open cPanel → Security → Encryption (called GnuPG Keys in some versions).
2. Under Create a New Key, enter your Name and Email (the address you will use, e.g. sara@example.com).
3. Optional Comment or Nickname.
4. Set a strong Key Password (passphrase). Without it the private key is useless, so store it in a password manager.
5. Choose an Expiration Date (one or two years is common) and Key Size 4096.
6. Click Generate Key and wait; generating a large key can take a minute.

Import someone's public key

1. On the same page, under Import Key, paste the recipient's public key block, starting with -----BEGIN PGP PUBLIC KEY BLOCK-----.
2. Click Import. It appears under Public Keys.

You can also import your existing private key here if you want Roundcube to decrypt mail on the server.

Share your public key

Under Public Keys, click View next to your key and copy the block. Send it to your contacts or publish it on your website. The public key is safe to share; never share the private key or passphrase.

Send and read encrypted mail

• Roundcube: if the Enigma plugin is enabled on the server, open Settings → Encryption to enable encryption features, then use the lock icon when composing to Encrypt and/or Sign. Roundcube asks for your passphrase to decrypt incoming messages.
• Thunderbird: has OpenPGP built in. Open Account Settings → End-To-End Encryption, add or import a key, then use the Encrypt button in the compose window. See Thunderbird email setup.
• Mobile: apps such as FairEmail (Android, with OpenKeychain) or third-party iOS apps support OpenPGP.

Limits to know

• The subject line and sender/recipient addresses are not encrypted.
• Server-side spam and virus scanning cannot inspect encrypted content.
• Searching encrypted mail in webmail does not find words in the body.

Troubleshooting

• Recipient cannot decrypt: you encrypted with an old or wrong public key. Ask them for their current key.
• Encryption options missing in Roundcube: the plugin is not enabled; use Thunderbird instead.
• Key expired: generate a new key and share the new public key.

Next steps

• Secure your mailbox
• Roundcube settings