PGP in Practice, Part 5: Sending encrypted email from Outlook / Microsoft 365

The Windows / Outlook PGP story is Gpg4win — a free, GPL-licensed bundle from the same project that maintains GnuPG, funded historically by Germany's Federal Office for Information Security (BSI). It ships:

• Kleopatra — Qt-based key manager. The closest equivalent to GPG Keychain on macOS.
• GpgOL — the Outlook add-in. Adds encrypt / sign toolbar buttons to Outlook's compose ribbon and verification UI to receive.
• GpgEX — Windows Explorer shell extension. Right-click any file to encrypt, decrypt, or sign.
• GnuPG — the gpg.exe binary itself.
• Kleopatra Compendium — a built-in PDF reference covering the standard workflows.

Two practical notes up-front. First, GpgOL works with desktop Outlook (2016, 2019, 2021, and Microsoft 365 desktop), but not Outlook Web App / Outlook on the Web. Second, GpgOL is COM-based, which means it sits inside Outlook's process; if Outlook crashes around it (rare, but it happens during major updates), GpgOL becomes invisible until you re-enable it from File → Options → Add-Ins.

Download the latest installer from gpg4win.org. Verify the SHA-256 hash against the published value on the same page (or, better, the OpenPGP signature on the installer — the same key has signed Gpg4win releases for years).

Run the installer with administrator privileges. Select all components on the first run (you can prune later). After install, restart Outlook — GpgOL only loads at Outlook startup. Verify the add-in is active: File → Options → Add-Ins should list "GpgOL" under "Active Application Add-ins."

Open Kleopatra. The toolbar offers "New Key Pair" and "Import."

• New Key Pair — wizard prompts for name, email, algorithm (RSA, DSA, ECC), and passphrase. The defaults are reasonable but check the algorithm — ECC (curve25519) is the modern choice; RSA-3072 is the conservative default. Set an expiry of 1–2 years.
• Import — load an existing from another machine. Kleopatra will prompt for the passphrase.