OpenPGP and S/MIME certificate manager

Kleopatra

Encrypt, sign and verify files and text with your own keys.

What it is for

The KDE front end for GnuPG. It manages your keys and the keys of the people you write to, and encrypts or signs anything from a message to a folder.

01Encrypt a file or message so only the intended recipient can read it.
02Sign something so others can verify it came from you and was not altered.
03Verify downloads and signatures, and keep a keyring of the people you correspond with.

Why it helps your privacy

Only the holder of the matching private key can decrypt. A network observer, or a mail provider, sees ciphertext.

Signatures prove who wrote something and that it was not changed on the way.

Private keys are held by the local gpg-agent, protected by a passphrase, and never uploaded.

OpenPGP needs no service and no sign-up. The tool works the same offline.

Onion services

Over Tor, by configuration

Keyserver lookups run through Tor. The keyserver itself is reached as a normal site over the network, not as an onion service.

How it is set up in Ombra

Tor-only key lookups: dirmngr is set to use Tor through a local forwarder, with LDAP off, so a lookup cannot go out directly.
Strong defaults: gpg is preset to long key IDs, SHA-512 preferences and no version comment in armored output.
Smartcards: scdaemon is installed, so a hardware key or smartcard works when it is attached to the VM.