PGP encryption: what it does and where it fits

In PGP encryption, you encrypt a message for someone's public key, and their software opens it with their private key. Sealbox has no OpenPGP: its site says "No OpenPGP" and calls the choice "Deliberate". This page explains what PGP does, from the standard itself, and where PGP serves and Sealbox does not.

PGP encryption encrypts a message with a random session key, then encrypts that session key to each recipient's public key. The recipient's software uses the private key to recover the session key, and then the message. In the sequence the RFC gives, a new session key is generated for each message. The standard that describes this is OpenPGP, RFC 9580, dated July 2024. It also defines digital signatures, and it leaves key storage and management out of its scope.

What PGP and OpenPGP mean

RFC 9580 says it is a revision of RFC 4880 ("OpenPGP Message Format"), which is a revision of RFC 2440, which itself replaces RFC 1991 ("PGP Message Exchange Formats"). RFC 9580 obsoletes RFC 4880, and the RFC Editor's page for RFC 4880 lists it as "Obsoleted by (1) RFC 9580: OpenPGP". A page that cites RFC 4880 cites a version that RFC 9580 obsoletes. The RFC also says: "Software that has already implemented those previous specifications may want to review Appendix B for pointers to what has changed." The sequence in this page is the one RFC 9580 gives, and software built on the earlier specifications may differ.

In section 15.1, RFC 9580 says IANA "has updated the name of the 'Pretty Good Privacy (PGP)' protocol group" to "OpenPGP". Here, PGP encryption means encryption as RFC 9580 specifies it. Its abstract says "OpenPGP provides encryption with public key or symmetric cryptographic algorithms, digital signatures, compression, and key management", and that the document exists to "publish all necessary information needed to develop interoperable applications based on the OpenPGP format".

How PGP encrypts a message

Section 2.1 of the RFC gives the sequence. The sending OpenPGP software "generates a random session key for this message", encrypts that session key "using each recipient's public key", and encrypts the message with "a message key derived from the session key". The receiving software "decrypts the session key using the recipient's private key", and then "decrypts the message using the message key derived from the session key". The RFC adds: "Each symmetric key is used only once, for a single object."

Signatures are a separate service, described in section 2.2: the sender "generates a signature from the hash digest using the sender's private key", and the receiver "generates a new hash digest for the received message and verifies it using the message's signature". The RFC says "Both digital signature and confidentiality services may be applied to the same message."

What a PGP public key and a PGP private key are, and who looks after them

In that sequence, the PGP public key encrypts the session key and the PGP private key recovers it. The RFC says: "Every OpenPGP Key has a fingerprint and a Key ID." On keeping keys, it says OpenPGP "provides functionality for encoding and transferring keys and certificates, though key storage and management are beyond the scope of this document". So the standard does not say where a key is stored or how it is managed.

Where PGP serves, and where Sealbox does not

Three cases follow from the missing OpenPGP.

• The other person uses PGP. The RFC exists to enable "interoperable applications", and with an app that has no OpenPGP the two sides share no format.
• You need an OpenPGP signature. The RFC defines signatures (section 2.2), and an app with no OpenPGP does not produce one.
• Either of you is not on an iPhone. To the question "iPhone only?" the site answers "Yes — iOS 26+ at launch."

Where Sealbox fits, and where it stops

Sealbox is an iPhone app where, in the site's words, you compose "before it touches any messaging app", producing "a sealed object that travels as ciphertext over any channel that can carry it". Keys are paired in the app, where the site says "No keyservers, no .asc files, no key-signing parties", and they "release only to your live, currently-enrolled biometrics; a passcode is not enough". On a lost phone, even one already unlocked once, the content stays sealed, "an engineering guarantee with no known public bypass, not a formal proof", and one more layer is yours to add: "a strong alphanumeric device passcode is what still stands if the chip itself is ever broken".

The limits, in the site's words:

• The other person needs the app. What you seal is "encrypted, authenticated, and bound to its reader", and, in the site's steps for reading a Sealbox, "To read one, select the received block → Share → Sealbox".
• Metadata. "Who you talk to, when, how often, that a Sealbox box went by, and how large it is — the channel generates this; no content layer can hide it."
• A compromised, unlocked device in active use. "Malware that reads your screen as you read is beyond any encryption app — for everyone."
• Compelled secrets. "If someone can force your biometrics with the device in hand, or compel your 24-word recovery phrase, they hold the keys — and read what hasn't been read yet and whatever arrives".

Related reading:

• How to encrypt iPhone messages: iMessage, RCS, SMS

Sources

• IETF: RFC 9580, OpenPGP — Verified on 2026-11-03
• RFC Editor: RFC 4880, OpenPGP Message Format — Verified on 2026-11-03

Frequently asked questions

What is a PGP key?

In PGP, a public key encrypts the session key of a message, and the matching private key recovers it (RFC 9580, section 2.1). Every OpenPGP key has a fingerprint and a Key ID. The standard puts key storage and management beyond its scope, so it does not say how a key is kept or managed.

What is the difference between PGP and OpenPGP?

RFC 9580 says IANA renamed its "Pretty Good Privacy (PGP)" protocol group to "OpenPGP". OpenPGP is the standard that RFC 9580 specifies, and RFC 9580 obsoletes RFC 4880, "OpenPGP Message Format". This page says PGP encryption where it means encryption as that standard specifies it.

How do you encrypt using PGP?

With software that implements OpenPGP. According to RFC 9580, to encrypt a message with PGP, that software generates a random session key, encrypts the message with a key derived from it, and encrypts the session key to each recipient's public key. This page does not teach a particular program, and Sealbox is not one.

Can Sealbox open a PGP message?

Sealbox has no OpenPGP: its site says "No OpenPGP" and "Deliberate". Keys are paired in the app, with "No keyservers, no .asc files, no key-signing parties." So a PGP key or message has no place in that exchange, and the other person needs Sealbox to read what you seal.