An OpenPGP message is a sequence of packets: public-key encrypted session keys, symmetrically encrypted and integrity-protected data (version 2 with AEAD in RFC 9580), literal data and signatures, optionally ASCII-armored. A key, or certificate, bundles a primary key, user IDs, subkeys and self-signatures that bind them. Trust is up to the user: fingerprints checked in person, certifications by others (web of trust), WKD lookups or keys.openpgp.org.
RFC 9580 (the "crypto refresh") replaced RFC 4880 with v6 keys and SHA-256 fingerprints, native Ed25519, Ed448, X25519 and X448, AEAD encryption (OCB required, GCM and EAX optional) and Argon2 passphrase protection; RFC 9980 (June 2026) adds post-quantum composite algorithms such as ML-KEM-768+X25519 and ML-DSA-65+Ed25519. GnuPG follows the competing LibrePGP specification for its newest formats, so v4 keys remain the common denominator.
Uses beyond e-mail: Linux distribution package and repository signing, Git tags and commits, release signatures (.asc files), password managers and backups. The OpenPGP inspector lists the packets of a key, signature or message.