Linux GPG Command to Password Protect Files

A backup file needs to stay readable to you while its contents remain protected from someone who finds the copy. GPG is a command-line program that creates a passphrase-protected file you can decrypt later.

This article shows how to encrypt a file and restore it under a chosen name. It also explains what to check before sharing the encrypted copy.

TL;DR

Use GPG symmetric encryption to create a passphrase-protected copy of a file, then decrypt it with the same passphrase.

• Encrypt with gpg –symmetric notes.txt.
• Decrypt with gpg –output notes-restored.txt –decrypt notes.txt.gpg.
• Keep the passphrase safe and check the decrypted file before removing any plaintext copy.

What is GPG file encryption?

GPG is the command-line program in GnuPG for working with OpenPGP data. Symmetric encryption uses one passphrase to encrypt and decrypt a file, so you do not need to create a public and private key pair for this local-file task.

The encrypted output is unreadable ciphertext until GPG decrypts it. GnuPG documents AES-256 as the default symmetric cipher. A passphrase protects access to the encrypted data, but GPG cannot recover that data if the passphrase is lost.

This is different from public-key encryption. For sending a file to another person without sharing a passphrase, you normally encrypt to that person’s public key, and the recipient decrypts with the matching private key. I focus on the symmetric mode here because the search is for a password-protected file.

The word symmetric describes how the same secret unlocks the encrypted data. Anyone who has the ciphertext and the passphrase can attempt to decrypt it, so possession of the encrypted file alone is not enough to keep it private if the passphrase is shared widely.

GPG packages the encrypted data in an OpenPGP message. A filename ending in .gpg is a common naming choice, but the suffix does not itself encrypt or protect anything. GPG reads the message format when you decrypt it.

The command’s default cipher is documented by GnuPG as AES-256. That is why this workflow does not add a cipher selection flag. Choosing a non-default algorithm adds a decision without helping a reader complete the basic passphrase task.

A password prompt and a GPG key passphrase are separate ideas. In this procedure, the prompt protects the file’s symmetric encryption. It is not asking you to unlock a private key, because the procedure does not use one.

How to password protect a file with GPG

Run gpg –symmetric on the source file, enter a passphrase when GPG prompts, and confirm it. The command creates a separate encrypted file with a .gpg suffix by default, leaving the source file in place.

Step 1: Check that GPG is available

Linux distributions provide GnuPG through their package repositories, but the package name and installation command depend on the distribution.

gpg --version

If the shell reports that it cannot find gpg, consult your distribution’s package documentation and install its GnuPG package. I keep installation separate from encryption because package-manager commands change the system and differ across Linux distributions.

Step 2: Move to the file and encrypt it

Change to the directory containing the file, then run the symmetric command with its path. The example below uses notes.txt. Replace that name with the file you intend to protect.

gpg --symmetric notes.txt

GPG prompts for a passphrase and asks you to enter it again. Type it at the prompt rather than adding it to the command line, where it could be exposed in shell history or process details. Use a long passphrase you can store safely.

After successful encryption, GPG writes notes.txt.gpg in the current directory. The original notes.txt remains. Encryption alone does not remove an unprotected copy.

Keep both names in mind while you work. The source path is the readable input, and the .gpg path is the encrypted result. Test decryption before removing the only readable copy.

If a file with the encrypted output name already exists, do not assume that GPG will replace it without asking. Read its prompt and confirm the path before accepting an overwrite. When in doubt, choose a distinct output path so a previous encrypted copy remains intact.

Relative paths are resolved from the directory where the command runs. If you are unsure which directory the shell is using, check the current working directory before typing the source name. An absolute path can remove ambiguity when the file is stored elsewhere.

Step 3: Decrypt to a chosen file

Use –decrypt and name the destination with –output. Choosing a different output name avoids accidentally replacing the original while you check the recovered data.

gpg --output notes-restored.txt --decrypt notes.txt.gpg

Enter the same passphrase used during encryption. GPG writes the decrypted content to notes-restored.txt. The encrypted file remains available for another copy or transfer.

Using –output makes the destination explicit. The shorter default decryption behavior can write a file based on the encrypted filename, which may not be the name or directory you intended. Naming the destination makes it clear where the readable result will appear.

GPG can also send decrypted bytes to standard output when no output path is supplied. That is useful when another command should consume the plaintext directly, but it can expose sensitive content in a terminal or downstream log. For a beginner’s file recovery, an explicit output file is clear to inspect and control.

If decryption reports a bad passphrase, check that you are using the passphrase created for this file. A cached passphrase can sometimes change whether GPG displays a prompt on a later operation. Do not treat the absence of a prompt as proof that no passphrase protects the file.

Step 4: Verify the restored content

Check that the output file exists and compare its content with what you expect before relying on it. For a text file, the cmp command can verify byte-for-byte equality while leaving both files untouched.

cmp notes.txt notes-restored.txt

A successful cmp run means the two paths contain identical bytes. It does not prove that the original file was trustworthy before encryption, so verify the source separately when that matters.

I ran a workspace round trip with a private passphrase file so the secret did not appear on screen. The output confirms GPG encrypted the file and that the decrypted bytes matched the source.

gpg: AES256.CFB encrypted data
gpg: encrypted with 1 passphrase
Encrypted file: demo-note.txt.gpg
Decrypted file matches source: yes

The screenshot shows a successful round trip, including the encrypted filename and the matching-file check. The secret passphrase itself is not shown.

The test run returned GPG’s AES256.CFB encrypted-data notice, then reported that the decrypted file matched its source. The comparison checks bytes rather than whether the file is meaningful or safe to use. Keep that distinction when recovering documents from an untrusted sender.

Common errors and what to do next

Several issues in this workflow come from a wrong path, an unavailable output location or a lost passphrase. Check these before changing the encryption command, then choose the next workflow based on whether you are protecting one file or sharing it.

• GPG cannot open the input. Check the filename and current directory, or provide the file’s absolute path.
• The output path cannot be written. Choose an existing directory where you have write access and avoid an important existing filename.
• The passphrase is rejected. Confirm you have the passphrase used for this ciphertext. GPG cannot recover a forgotten symmetric passphrase.
• You need to protect a folder. Check the installed gpgtar –help and GnuPG manual for archive options before using symmetric archive mode.

After resolving an error, retry against a separate output path and compare the recovered file with the source when both are available. This keeps a failed attempt from overwriting a copy you still need.

What should you check before sharing a GPG file?

A .gpg file is useful only while you can supply its passphrase and still have a workable copy of the data. Check the plaintext copy, the encrypted output and the recovery path before treating the task as complete.

• Do not lose the passphrase. GPG cannot decrypt symmetric ciphertext without it. Store it in a trusted password manager or another protected place, separate from the file.
• Remember the original remains. The encryption command creates a new output. It does not securely erase the source. First decrypt and check a recovery copy before deciding what to do with the original.
• Choose an output path that exists and is writable. Decryption can fail if the destination directory is missing or GPG cannot write there. Avoid naming the output after an important existing file unless you intend to replace it.
• Use a different method for recipients. A shared passphrase means anyone who knows it can decrypt the file. Public-key encryption is a better fit when the recipient has a verified key pair and you should not send them a shared secret.

A forgotten passphrase is a serious limit, not a prompt that can be bypassed by renaming the file. Keep the passphrase in a place you can recover independently of the encrypted file. Test a recovery copy before relying on the encrypted version as your only copy.

Encryption also does not hide every detail around a file. The .gpg filename, its size and the fact that an encrypted object exists can still be visible to someone who can inspect the directory. GPG protects the contents, not every surrounding piece of metadata.

For a folder, gpgtar is the GnuPG helper that packages files and directories into an archive. Its manual documents combining archive encryption with symmetric encryption. An archive is practical when several paths must travel together, while a single file can go straight through gpg.

Choose the archive workflow only when you need its grouping behavior. It creates a different kind of output from encrypting one file, so check the archive and destination names before sharing or storing it. Keep a separate test extraction or restoration step in a backup plan.

For sharing with another person, symmetric encryption creates a key-distribution problem: the recipient needs the same secret, and the secret must reach them through a separate channel. If that arrangement is unsuitable, use recipient-based encryption with the recipient’s verified public key instead of sending a passphrase beside the ciphertext.

When GPG reports that it cannot open an input or output file, check the path and directory permissions before changing anything. A misspelled source path and a destination directory that does not exist can look like cryptographic trouble even though GPG never reached the encryption step.

For a directory or several files, GnuPG’s gpgtar can create an encrypted archive with symmetric mode. Its manual documents the –create, –symmetric and –output options. Check the installed gpgtar –help output and current manual for option support before using it in a backup workflow.

Conclusion: Keep the passphrase with the encrypted file

gpg –symmetric protects one file using a passphrase, and gpg –decrypt restores it when you provide that passphrase. Keep a verified recovery path and remember that an encrypted copy does not automatically remove the original.

For exact option behavior, see the GnuPG operational command manual and the gpgtar manual.

FAQ

These answers distinguish the common GPG terms and the two encryption modes.