Linux: How To Encrypt And Decrypt Files With A Password

To encrypt and decrypt files with a password, use gpg command. It is an encryption and signing tool for Linux and UNIX-like operating systems such as FreeBSD, Solaris, MacOS and others. Gnupg is a complete and free implementation of the OpenPGP standard.

Where security is critical, we use strong encryption such as Pretty Good Privacy/GNU PGP instead of the relatively weak standard encryption provided by many CLI utilities. Let us see how to encrypt and decrypt files on Linux and Unix command-line.

Say hello to gnupg

The GnuPG stands for GNU Privacy Guard and is GNU’s tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility.

Install gnupg in Debian/Ubuntu/Mint Linux

Type the following apt-get command or apt command:
$ sudo apt-get install gnupg

Installing gnupg in Red hat (RHEL)/CentOS Linux

Type the following yum command:
$ sudo yum install gnupg

Fedora Linux install gnupg

Type the following dnf command:
$ sudo dnf install gnupg

Arch Linux install gnupg

Type the following gnupg command:
$ sudo pacman -S gnupg

SUSE/OpenSUSE Linux install gnupg

Type the following zypper command:
$ sudo zypper install gpg2

FreeBSD install gnupg command

To install the port:
# cd /usr/ports/security/gnupg/ && make install clean
To add the package:
# pkg install gnupg

OpenBSD install gnupg

$ doas pkg_add gnupg
Please note that you can use either gpg or gpg2 command.

Encrypting a file in Linux or Unix

To encrypt a single file, use command gpg as follows:
$ gpg -c filename
To encrypt myfinancial.info.txt file, type the command:
$ gpg -c myfinancial.info.txt
Sample output:

Enter passphrase:<YOUR-PASSWORD>
Repeat passphrase:<YOUR-PASSWORD>

This will create a myfinancial.info.txt.gpg file:
$ ls -l myfinancial.info.txt*
Sample outputs:

-rw-rw-r-- 1 vivek vivek  23 Jan 13 15:01 myfinancial.info.txt
-rw-rw-r-- 1 vivek vivek 113 Jan 13 15:01 myfinancial.info.txt.gpg

Where,

• -c : Encrypt with a symmetric cipher using a passphrase. The default symmetric cipher used is AES128, but may be chosen with the --cipher-algo option.

You can delete myfinancial.info.txt file:
$ rm myfinancial.info.txt
Please note that if you ever forgot your password (passphrase), you cannot recover the data as it use very strong encryption.

Decrypt a file in Linux or Unix-like system

To decrypt file use the gpg command as follow:
$ gpg myfinancial.info.txt.gpg
OR
$ gpg -d myfinancial.info.txt.gpg
OR
$ gpg --decrypt myfinancial.info.txt.gpg
Sample outputs:

gpg myfinancial.info.txt.gpg
gpg: CAST5 encrypted data
Enter passphrase:<YOUR-PASSWORD>

To view your file, type:
$ ls -l myfinancial.info.txt
$ cat myfinancial.info.txt
$ vi myfinancial.info.txt
Decrypt file and write output to file vivek.info.txt you can run command:
$ gpg myfinancial.info.gpg -o vivek.info.txt
OR
$ gpg -d myfinancial.info.gpg --output vivek.info.txt
Also note that if file extension is .asc, it is a ASCII encrypted file and if file extension is .gpg, it is a binary encrypted file.

How to create compressed encrypted archives with tar and gpg for given directory or folder

The syntax is as follows to make encrypted archives with tar and gpg for whole directory:
tar -cz /path/to/dir/ | gpg -c -o your_file.tgz.gpg
Optionally, you can delete the /path/to/dir/ as it is fully encrypted and backed up to the your_file.tgz.gpg. Here is how to unpack it when needed:
gpg -d your_file.tgz.gpg | tar xz

A note about keeping the password in a separate file for backups or cron jobs

See this comment below.

Encrypting and decrypting file using the public keys on Linux and Unox

The syntax is simple again:
{vivek@desktop.local}% gpg --output outFileName.gpg --encrypt --recipient sai@cyberciti.biz inputFileName.txt
The encrypted document can only be decrypted by someone with a private key that complements one of the recipients’ public keys. To decrypt a message the option –decrypt is used as follows:
{sai@laptop.remote}% gpg --output inputFileName.txt --decrypt outFileName.gpg
See how to use oathtool Linux command line for 2 step verification (2FA) along with GNU PGP.

Conclusion

We learned how to encrypt and decrypt files on Linux and Unix-like systems using strong encryption. See the following resources:

• GnuPG Frequently Asked Questions
• Consult man page of gpg using the man command:
  man 1 gpg