PGP stands for Pretty Good Privacy, a public-key cryptography system created by Phil Zimmermann in 1991. The open standard derived from it is OpenPGP (RFC 4880); the most common implementation is GnuPG (GPG). Used to encrypt and digitally sign email, files, and software releases. The de facto authentication standard for verifying that a software download came from the project that signed it.
What it means in practice
PGP is the high-trust, high-friction option for email encryption between technical users. The mechanics: each user generates a keypair (public + private), publishes the public key (keyserver, website, business card), keeps the private key offline or password-protected. To send encrypted email, the sender encrypts with the recipient’s public key; only the recipient’s private key decrypts. To sign a message, the sender signs with their private key; anyone with the public key verifies the signature. The trust model is the “web of trust” (key signatures by mutually-known parties) or, more commonly today, out-of-band fingerprint verification. The friction is real: key management, expiration, revocation, recovery from a lost private key are operational problems most users do not want.
Where it shows up
Used heavily by: investigative journalists for source contact (SecureDrop relies on PGP for case-by-case file encryption), security researchers coordinating vulnerability disclosures, open-source maintainers signing release artifacts (every Debian package, every Tor Browser release, every Linux kernel build is PGP-signed), Bitcoin developers signing commits and binaries. Used lightly by: anyone whose threat model justifies the friction. The realistic alternative for most operators is ProtonMail (PGP under the hood, hidden from the user) or Tutanota (parallel public-key system, also hidden from the user). Pure GPG-on-Thunderbird is for the small population that needs the auditability of the toolchain end to end.
What you can change today
Two paths depending on threat model. Path A (most users): use ProtonMail, which gives you PGP-equivalent encryption between Proton users without managing keys, and OpenPGP-compatible exchange with non-Proton users who have published a key. Path B (high-friction operators): install GnuPG (gpg –gen-key), generate an RSA 4096 or Ed25519 key with a 2-year expiration, publish the public key on keys.openpgp.org, write your fingerprint on the back of your business card, and start signing every release or sensitive email. Whichever path: print your private-key passphrase recovery phrase, store it offline, and assume you will need it during the worst possible week of your life.