How to Set Up OpenPGP Email Encryption in Thunderbird 115 Supernova

Thunderbird’s built-in OpenPGP can encrypt an email so that only recipients with the matching secret key can read its protected content. In Thunderbird 115 Supernova, set up a personal key under Account Settings → End-to-End Encryption, obtain and verify each recipient’s public key, and turn on encryption in the message’s security controls before sending.

Version note: Thunderbird 115 is now a legacy release. Mozilla’s release notes identify Thunderbird 115.18.0 ESR, released December 11, 2024, as the final Thunderbird 115 release. For current sensitive email, install a currently supported Thunderbird version and use its current security updates. The workflow below is written for the Thunderbird 115 Supernova interface; some labels may differ in newer releases.

What does OpenPGP protect, and what do you need first?

OpenPGP uses a key pair. Your public key can be shared so that other people can encrypt messages to you. Your secret key stays under your control and decrypts those messages. To send encrypted mail to someone, you need that person’s public key; the recipient must have the matching secret key available in their mail client.

End-to-end encryption is a two-person setup, not a switch that works with every address automatically. Each recipient must have a usable, accepted key, and you need a personal key for the account identity you are sending from. Thunderbird may block an encrypted message if a recipient key is missing. Mozilla’s introduction to end-to-end encryption describes this setup and the need to protect your secret key.

Before you begin, have access to the correct email account in Thunderbird, choose a strong passphrase for any key backup, and plan a safe backup location. If you already have an OpenPGP key in GnuPG or another mail program, decide whether to import that key rather than creating a second one. Reusing the same personal key across devices can let you read encrypted messages on each device, but only if you safely install the key on each one.

How do you create a personal OpenPGP key in Thunderbird 115?

1. Open the Thunderbird application menu using the three-line button, then choose Account Settings. You can also reach Account Settings from the application menu bar.
2. Select the email account or identity you intend to use in the left column, then open End-To-End Encryption.
3. In the OpenPGP section, select Add Key…. Choose the option to create a new OpenPGP key rather than import an existing one.
4. Review the account address associated with the key and the expiration choice shown in the dialog. A key with an expiration date may require you to renew or replace it later; a key without one avoids that date but does not remove the need to protect and eventually replace a compromised key.
5. Confirm the dialog to generate the key. When Thunderbird offers the key as the account’s personal key, select it and confirm the assignment.

Use a separate key for each email address that needs its own identity unless your setup intentionally associates multiple addresses with one key. Mozilla notes that Thunderbird needs a personal key for each address used to receive encrypted mail or send signed messages. The Mozilla account setup guide describes the personal-key requirements, including that a usable key must be current, not revoked, and include the matching address.

Back up the secret key before relying on it

Your secret key is essential to reading messages encrypted for you. If it is lost, senders may still encrypt new mail to your public key, but you may not be able to decrypt it. In Account Settings, use the menu beside the configured key to choose the backup or export action. Store the backup somewhere protected and separate from the computer, and remember its passphrase. Never send the secret-key backup to a correspondent or publish it online.

Consider setting Thunderbird’s Primary Password under its privacy and security settings. Mozilla’s OpenPGP FAQ says keys stored in Thunderbird’s profile are not protected by a Primary Password; someone with access to an unlocked profile may be able to use the keys. A Primary Password adds protection when Thunderbird starts, but it does not replace a secure computer login or a protected backup.

How do you share your public key safely?

To let someone send encrypted email to you, give them your public key. In the compose window, use the security control’s menu to attach your public key, or open the key’s details from Account Settings or the OpenPGP Key Manager and export the public key. You can send the resulting public-key attachment or share it through another channel. A digitally signed email can also include a copy of your public key so the recipient can verify your signature.

Before relying on the key, help the other person check its fingerprint. A fingerprint is a short identifier calculated from the full key. Compare the fingerprint through a separate channel, such as a phone call or an in-person conversation. Do not treat a name, email address, keyserver result, or attachment as proof by itself: anyone can create a key that claims to belong to another person. Mozilla explains this risk in OpenPGP keys might be authentic or counterfeit.

How do you import and verify a recipient’s key?

1. Ask your correspondent to send their public key or provide a verified download source. A public key often arrives as an .asc attachment. Thunderbird’s OpenPGP Key Manager can also discover some published keys using supported methods.
2. Import the public key from the attachment prompt or through Tools → OpenPGP Key Manager. If the menu bar is hidden, open the application menu or enable the menu bar from Thunderbird’s window options.
3. Open the key’s details and compare its fingerprint with the fingerprint your correspondent provides over a separate, trusted channel.
4. Only after the match, mark the key as verified or accepted. The exact wording in the confirmation can vary by key state and Thunderbird build.

For a low-risk test, you may decide to accept an unverified key, but understand the difference: encryption to a false key can give an attacker access to the message while making it look protected. For financial, legal, health, or other confidential conversations, verify the fingerprint before accepting the key.

How do you encrypt a message in Supernova?

1. Select Write and check the From address at the top of the compose window. It must be the identity for which you configured a personal OpenPGP key.
2. Enter the recipient and wait for Thunderbird to check whether a usable public key is available. Repeat this check for every recipient, including copied recipients.
3. Open the message security control on the compose toolbar. In Thunderbird 115, use the security or OpenPGP controls to enable encryption; the precise button presentation can depend on toolbar customization and account configuration.
4. Review the message security status before sending. Thunderbird 115 changed OpenPGP messages to use combined signing and encryption by default, so an encrypted message can also be digitally signed. A signature helps recipients check that the message was not altered and that it corresponds to your key.
5. If Thunderbird reports a missing or unacceptable key, stop and resolve the key issue. Do not disable encryption merely to get the message sent if the content is sensitive.

Thunderbird 115 may offer a setting for an encrypted subject. Even when enabled, ordinary email still has routing information such as sender and recipient addresses and timestamps. Check the security options for the specific message and avoid putting confidential details in the subject unless you have confirmed how it will appear for your recipient. Encryption does not hide the fact that email was exchanged.

How can you test the setup before sending sensitive mail?

Send a harmless test message to yourself using the same account identity and enable both encryption and signing. Open the message in your inbox and confirm that Thunderbird decrypts it and reports the signature status. Then ask your correspondent to send you a short encrypted test and confirm that you can open it. A successful test checks the key and account setup; it does not prove that an unverified key belongs to the person it names.

When receiving protected mail, Thunderbird may ask for a passphrase or use your configured key protection, then display the decrypted content in the message window. If you cannot decrypt a message, confirm that the receiving profile has the correct secret key, that the key is not expired or revoked, and that the sender encrypted to the matching address and key.

What OpenPGP does not guarantee

• It cannot encrypt to someone without a usable public key. Every recipient needs a matching key pair and a compatible mail client.
• It does not make a public key authentic automatically. Verify important keys out of band to reduce the risk of a counterfeit key.
• It does not protect a compromised device. Malware, a stolen unlocked computer, or someone who obtains your secret key can undermine confidentiality.
• It does not guarantee every mail client can read the message. Confirm that the recipient’s client supports OpenPGP and test attachments and message handling before using it for a time-critical exchange.
• It does not make Thunderbird 115 current or supported. Because 115.18.0 ESR was the final Thunderbird 115 release, use a current supported version for ongoing security fixes.

Official references

• Thunderbird 115.18.0 ESR final release notes
• Introduction to end-to-end encryption in Thunderbird
• Set up an email account for end-to-end encryption
• OpenPGP in Thunderbird: how-to and FAQ
• How to identify a counterfeit OpenPGP key