Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

Question

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data?

If the latter, then if someone had access to your private key alone, would they be able to decrypt all your messages?

Thanks in advance, I haven't been able to find a clear answer.

Answer 1

The former. Your PGP private key is stored on your disk in encrypted form. In particular, It is encrypted under your passphrase.

To decrypt a file, PGP needs (1) your passphrase, and (2) the encrypted private key file; from these it can reconstitute your private key, and then decrypt the file. Neither alone is sufficient.

To answer your question, your client does encrypt your private key. It is stored on your disk in encrypted form.

(I am assuming you are using public-key encryption, not conventional encryption.)