Sorry if this is more of a conceptual question. I was using GPG to send encrypted emails back and forth with a friend and I understand why I am able to decrypt the messages my friend sends me: because that data was encrypted using my gpg public key and I have the corresponding private key.

But for fun, once I encrypted some data using my friend's public gpg key, I highlighted it and chose "OpenPGP: Decrypt Selected" and it worked. I don't have my friend's private key anywhere in my GPG Keychain. So I don't understand this because I thought that only the corresponding private key is able to decrypt the ciphertext.

It seems that possibly both public keys are used when encrypting data (i.e. in an email)?? It's not like the sender doesn't know what data they encrypt and send but wouldn't this mean that now there are two private that can decrypt the data vs just the one?

I've been reading through their manual but I only see explanations on the different types of cryptosystems, nothing explicitly stating how GPG works and what it is using.

  • Is it possible you were using symmetric encryption instead of asymmetric encryption? With symmetric encryption, the same key is used for encryption and decryption. That might explain how you were able to encrypt the plaintext with your friend's public key, then use the same public key to decrypt the ciphertext.
    – mti2935
    Commented Jun 25, 2021 at 23:40
  • I didn't realize you could choose the encryption system when generating a GPG key. When I created it, under Advanced options for the Key Type field I chose RSA and RSA (default) which is asymmetric.
    – Tikiyetti
    Commented Jun 25, 2021 at 23:48

2 Answers 2


PGP (generically) can encrypt a message to multiple publickeys; this was originally intended for emails to multiple recipients but can be used to include yourself, and GnuPG has an option to include yourself that can be configured to do so automatically, see --encrypt-to in https://www.gnupg.org/documentation/manuals/gnupg/GPG-Key-related-Options.html#GPG-Key-related-Options .

Commandline gpg by default displays the keyid and userid used to decrypt (or verify) a file, and when it prompts for the passphrase on a privatekey it tells you which key it's asking for; these would show the key being used to decrypt your message to be your own key. If you're using one of the many different GUI frontends, it may show this information differently or not at all; you'll have to be more specific about what you're using.

See PGP question decrypting my own message from 2 days ago
Does OpenPGP encryption mean that not even I can see my data?
and https://superuser.com/questions/1389024/gpg-difference-encrypt-to-and-recipient .

  • I see, well that makes sense. Thank you for clarifying! I appreciate the answer.
    – Tikiyetti
    Commented Jun 26, 2021 at 0:49

You are encrypting the data to both your and your recipients' public keys. This is a commonly desired behavior when using GPG, as it lets you read your own sent messages and so on.

I'm not sure if there's a config option for the actual gpg binary that enforces this behavior by default, though there might beEDIT: as Dave Thompson points out above, there's the --encrypt-to config option for this. However, you mention that you're using a GUI on top of GPG; most such GUIs encrypt-to-self by default or at least have an option for it. You can probably disable this behavior if you don't want it. However, without knowing exactly what software you're using, I can't directly tell you how.

  • Thank you for the answer. I'm not really looking to disable but that's not to say I might not want to in the future for some reason; so I'm glad you pointed it out as I wasn't aware. I am using the GPG Suite for mac os from here: gpgtools.org
    – Tikiyetti
    Commented Jun 26, 2021 at 0:46
  • Yes there is a ~/.gnupg/gpg.conf file I found where I can enable/disable the encrypt-to-self flag. But no gui options that I can see. Just in case anyone came here looking for that info. Thanks again for your help!!
    – Tikiyetti
    Commented Jun 26, 2021 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .