I cannot seem to get gnupg to decrypt files encrypted with my keys. I've tried migrating my secret key from an old laptop to a new one, and I keep getting the same error:

gpg: decryption failed: No secret key

I tried exporting my public, secret, and subkeys from my old laptop as follows:

gpg --export MYKEYID > pub.key
gpg --export-secret-keys MYKEYID > sec.key
gpg --export-secret-subkeys MYKEYID > sub.key

I then copied them to my new laptop, and imported them as follows:

gpg --import pub.key
gpg --import sec.key
gpg --import sub.key

Then I edited the key to give it ultimate trust:

gpg --edit-key MYKEYID

gpg> trust
Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

yet no matter what, it fails to decrypt:

gpg --decrypt -v encryptedfile.gpg
gpg: public key is E78E22A13ED8B15D
gpg: encrypted with ELG key, ID E78E22A13ED8B15D
gpg: decryption failed: No secret key

Version on old laptop:

gpg --version
gpg (GnuPG) 2.1.21
libgcrypt 1.7.6

Version on new laptop:

gpg --version
gpg (GnuPG/MacGPG2) 2.2.3
libgcrypt 1.8.1
  • Does gpg --list-keys show your private key? – Peter Harmann Apr 29 '18 at 20:57
  • 3
    Does --list-secret-keys show your secret key? Maybe you need to set (even though the manpage says otherwise) allow-secret-key-import. Also: Voting to migrate to SU. – Tobi Nary Apr 29 '18 at 21:42

This was entirely my fault. I'm not sure what happened, but the file I was trying to decrypt was not encrypted by my key. I tried a different file and it worked.

I'm not sure how that happened, but testing the same file on the old machine first would have saved me a ton of time :).


I randomly started getting the error

gpg: decryption failed: No secret key

as well, when attempting to decrypt files. Strangely, GPG was telling me that the files were encrypted with a different key ID than my own (despite identifying my name and the date of the key’s creation correctly). I restarted my computer and the problem went away.

I’m guessing there is a bug where some bit can get misaligned in the GPG daemon’s memory, and then it will need restarting.


This message can also happen if your key is protected with a passphrase, and your pinentry program isn't working properly.

In this case, gpg can't get the passphrase to unlock the decryption key. If this is the case, gpg --list-keys will show the correct key, but gpg -d -v will appear to select the correct key and then just hang for a while before giving up. This is it waiting for the pinentry that never actually returns.

The steps depend on your specific environment, but checking (or creating) the pinentry-program option in ~/.gnupg/gpg-agent.conf is a good place to start. In my case (on OS X with Homebrew-installed gpg and pinentry-mac) I had to create that file with the following contents:

pinentry-program /usr/local/bin/pinentry-mac

You may need to adjust as needed for whatever your preferred pinentry program is.


I got the error:

gpg: decryption failed: No secret key

after I closed a gpg prompt with Ctrl+C, so maybe there was still some state hanging around.

I fixed it by killing the gpg-agent process:

$ ps aux | grep gpg-agent
user             76882   0.0  0.0  4297004    996   ??  Ss   11:51AM   0:00.02 gpg-agent --homedir /Users/user/.gnupg --use-standard-socket --daemon

$ kill 76882

Also for me, as for Jackson the solution was to reboot, but I want to give the context in which I hit the problem, in case it can be useful to whoever comes to this thread.

I hitted the gpg: decryption failed: No secret key error one day when trying to retrieve a password from my store using pass, which I use daily, and the issue was solved by rebooting. Before that error, the closest to "keys" things that I had done were:

  • the day before, generating an SSH key with ssh-keygen -t rsa -b 2048, which to me seems unrelated;
  • the day itself, temporarly commenting out the line export GPG_TTY=$(tty) from my ~/.bashrc.

I got the error gpg: decryption failed: No secret key when trying to decrypt a message that I encrypted for someone else.

To be able to decrypt it, I had to encrypt the message using --recipient parameter 2 times with both the receiver and sender ID (https://stackoverflow.com/questions/597188/encryption-decryption-with-multiple-keys).


try to use root privileges, such as sudo gpg ... I think that gpg elevated without permissions does not refer to file permissions, but system

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.