PGP — Pretty Good Privacy — is one of the oldest working answers to a problem email still hasn’t fully solved: by default, email is sent in the clear, readable by anyone who intercepts it in transit or gets into a mailbox it passes through. PGP encrypts the message itself, not just the connection carrying it, so the content stays unreadable to everyone except the intended recipient — including your own mail server.
How PGP Actually Works
PGP uses public-key cryptography: every user generates a key pair — a public key they share freely, and a private key they never share. To send someone an encrypted message, you encrypt it with their public key; only their private key can decrypt it. To prove a message really came from you, you sign it with your private key, and anyone with your public key can verify the signature.
The part that trips people up: PGP doesn’t use a certificate authority to vouch for whose key is whose. Instead it uses a “web of trust” — you personally verify someone’s key (in person, by phone, via a keysigning event) and vouch for it, and trust propagates through a network of people who’ve vouched for each other. That’s elegant for individuals and open-source communities. It’s genuinely difficult to operate at enterprise scale, where you need hundreds of employees’ keys managed, rotated, and revoked centrally — not built up person-by-person through informal trust chains.
PGP vs. S/MIME — the Distinction That Actually Matters for a Business
This is the question most “what is PGP” searches are really asking, even when they don’t know it. Both PGP and S/MIME do the same fundamental job — public-key encryption and digital signatures for email — but they get the “whose key is whose” question answered in opposite ways:
- PGP: decentralized web of trust. No central authority; trust is built key-by-key, person-by-person. Flexible, but hard to administer, audit, or revoke centrally across an organization.
- S/MIME: centralized Certificate Authority (CA) model — the same trust architecture that secures HTTPS. An organization (or a CA it trusts) issues, manages, and can revoke certificates for every employee centrally — without depending on the departing employee’s own action.
For an individual journalist, activist, or open-source maintainer, PGP’s decentralization is a feature. For a business trying to guarantee that every employee’s email is encrypted correctly, that a departing employee’s key gets revoked the day they leave, and that an auditor can verify the whole chain of trust in one place — S/MIME’s centralized CA model is almost always the more manageable choice. That’s not a knock on PGP; it’s just a different tool built for a different trust model.
Is PGP Still Used in 2026?
Yes, but mostly in specific niches: security researchers, journalists communicating with sources, open-source software signing (verifying that a code release really came from its maintainer), and privacy-focused individual users. Mainstream email clients still don’t support it natively — it typically requires a browser extension or dedicated client — which is the single biggest reason it never became the default for business email, despite being technically sound and decades old.
Is Encrypted Email Actually Secure?
Properly implemented, yes — the cryptography itself (PGP’s RSA/ECC key pairs, S/MIME’s certificate-based signing) is not the weak point. The real-world failure modes are almost always operational: a private key stored unencrypted on a laptop, a certificate that never gets revoked after an employee leaves, or — most commonly — encryption simply not being turned on for the messages that actually needed it. “Is encrypted email secure” is really two questions: is the cryptography sound (yes), and is your organization actually using it correctly and consistently (that’s the part worth auditing).
What This Means for Choosing Business Email Encryption
If you’re evaluating encrypted email for a business rather than personal use, the practical checklist is different from “is PGP good crypto” (it is):
- Can you issue and revoke certificates/keys centrally — the day someone joins or leaves, not whenever they happen to update their own key?
- Does it work in the mail clients your team already uses — webmail, Outlook, mobile — without a separate plugin everyone has to install and remember to use?
- Who controls the Certificate Authority — a third party abroad, or your own organization? For regulated industries, this is often the deciding question.
- Is encryption enforced by policy, or does it depend on every employee remembering to turn it on for the right messages?
How XgenPlus Handles This
XgenPlus runs an in-house PKI / Certificate Authority for S/MIME — message-level signing and encryption where your organization controls the trust chain, not a third party abroad. Certificates are issued and revoked centrally through the same admin console used for user management, and S/MIME works natively in mainstream desktop and enterprise mail clients (Outlook, Apple Mail, and Gmail on Google Workspace Enterprise tiers) without a separate plugin. Built on 25+ years in email infrastructure across 50M+ mailboxes, including deployments where an auditable, centrally-controlled trust chain is a compliance requirement, not a nice-to-have.
Frequently Asked Questions
What does PGP stand for, and what does it actually do?
PGP stands for Pretty Good Privacy. It encrypts an email’s content using public-key cryptography, so only the intended recipient’s private key can decrypt it, and it can digitally sign messages to prove they weren’t altered and really came from the claimed sender.
What’s the difference between PGP and S/MIME?
Both do public-key email encryption and signing, but they establish trust differently. PGP uses a decentralized “web of trust” where users personally vouch for each other’s keys. S/MIME uses a centralized Certificate Authority that issues certificates and can revoke them centrally for an entire organization, without depending on a departing employee’s own action — generally the more manageable model for business use.
Is PGP still relevant, or has it been replaced?
It’s still used, particularly by security researchers, journalists, and open-source projects, and the underlying cryptography remains sound. It never became the mainstream business default mainly because major email clients don’t support it natively — it needs a separate plugin or client, which is exactly the adoption friction S/MIME’s native client support avoids.
Is encrypted email actually secure, or just secure in theory?
The cryptography itself is sound in both PGP and S/MIME. Real-world failures are almost always operational — an unrevoked certificate after someone leaves, a private key stored insecurely, or encryption simply not being enabled for messages that needed it. The technology isn’t the weak point; consistent enforcement is.
Should a business choose PGP or S/MIME for email encryption?
For most businesses, S/MIME’s centralized Certificate Authority model is easier to administer at scale — certificates can be issued and revoked centrally, and it works natively in mainstream desktop and enterprise mail clients. PGP’s decentralized web of trust suits individual users more than organizations needing centralized, auditable control.
Final Thoughts
PGP isn’t obsolete — it’s just built for a trust model (decentralized, person-to-person) that doesn’t map cleanly onto how a business needs to manage encryption across dozens or thousands of employees. If you’re evaluating encrypted email for an organization rather than personal use, the real question isn’t “is PGP good enough” — it’s whether you can centrally issue, audit, and revoke trust the moment you need to.
- See XgenPlus’s S/MIME & in-house PKI — centralized certificate management, native client support.
- Full security & compliance overview.
- See plans and pricing.
- Talk to our team about encrypted email for your organization.
