PGP in Practice, Part 2: Sending encrypted email with Thunderbird
Thunderbird ships native OpenPGP support since version 78 — the easiest path into encrypted mail for most operators. This part walks through key generation / import, sending and receiving, the smartcard / YubiKey path, and the common gotchas (HTML mail breaking signatures, MIME vs inline, multiple identities sharing one key).
Thunderbird is the easiest path into PGP for new operators, and that's not an opinion — it's a function of the architecture. As of version 78 (released August 2020, replacing the long-running Enigmail add-on with first-class support), Thunderbird ships native OpenPGP. No external GPG binary required, no separate plugin to keep updated, no second keychain to sync. Keys live inside the Thunderbird profile, the toolbar exposes encrypt and sign as plain checkboxes, and the friction of every other client on this list goes away.
If you're standing up PGP for the first time, set up Thunderbird first — even if your daily-driver mail is Gmail or Outlook. Use it as your verification harness while you learn what a correctly-encrypted message looks like, and only then graduate to the integration in your real client.
Install Thunderbird 115 ESR or newer from thunderbird.net. The packaging on macOS, Windows, and most Linux distributions is straightforward; on Linux specifically, prefer the upstream tarball or your distro package over a Snap or Flatpak unless you've checked their permission models — sandboxed Thunderbird has historically had issues reaching gpg-agent for smartcard use.
On first launch, Thunderbird's Account Hub asks for an email address and credentials. Autodetection covers most provider configurations (Gmail OAuth, Microsoft 365 modern auth, generic IMAP/SMTP), but two pitfalls catch operators:
- Gmail with two-factor enabled. The legacy "App Password" path is being deprecated. Use the OAuth flow — Thunderbird 115+ handles it natively, opening a browser window to consent. If your Google Workspace admin has disabled OAuth for desktop apps, you'll need them to re-enable it for Mail (IMAP/POP/SMTP).
- Microsoft 365 / Exchange Online. Modern auth works, but Conditional Access policies that block "non-modern" or "legacy" client access will reject Thunderbird unless your tenant explicitly trusts it. The fix is on the M365 admin side, not yours.
Once the account is connected and you can send / receive plaintext mail, move on to the key.
Open Account Settings → End-To-End Encryption. The dialog has two paths:
— generate a key inside Thunderbird. The defaults are sane: ECC (curve25519) for new keys, expiry set to three years. If you'd rather use RSA-4096, switch the algorithm in the advanced section.