Encrypt and Decrypt Files on Android with GnuPG (Termux)

1. Open the Google Play Store (or F‑Droid) and install Termux. The F‑Droid version updates more frequently.
2. Launch Termux. The first run will prompt you to allow storage access. Tap Allow so that GPG can read and write files outside the app sandbox.
3. Update the package list and upgrade existing packages:

   pkg update && pkg upgrade -y

   This ensures you get the latest gnupg build.

1. In the same Termux session, run:

   pkg install gnupg

2. Wait for the installation to finish. The gnupg package includes gpg, gpg-agent, and related utilities.

1. Generate a key with a command that prompts for the required details:

   gpg --full-generate-key

2. When asked for the key type, choose RSA and RSA (default) by pressing 1 and Enter.
3. Set the key size. 4096 bits provides strong security without noticeable performance impact on modern phones. Type 4096 and press Enter.
4. Define the key’s expiration. For everyday use, a 2‑year expiry is a good balance. Type 2y (or 0 for never) and confirm.
5. Enter your real name and email address when prompted. These identifiers help recipients verify the key.
   You can leave the comment field blank; it’s optional.
6. Choose a strong passphrase. Use at least 12 characters, mixing upper‑case, lower‑case, numbers, and symbols. The passphrase protects the private key if the phone is lost.
   Never reuse passwords from other services.
7. After confirming the passphrase, GnuPG will generate entropy. On a mobile device this can be slow; you can speed it up by moving the device, shaking it, or using the rngd utility (optional). Once completed, you’ll see a key fingerprint like:

   pub   rsa4096 2023-01-01 [SC]
         3A5F 9C2D 7E8B 1F4A 6D3E  9A2B C4D5 E6F7 8A9B C0D1

1. Run the following to create an ASCII‑armored export (easy to copy‑paste or email):

   gpg --armor --export your.email@example.com > ~/mykey.asc

2. The file mykey.asc now resides in Termux’s home directory (/data/data/com.termux/files/home). Use the Android share sheet to send it:

   termux-share -a send -c text/plain -f ~/mykey.asc

   This opens the standard Android share dialog, letting you email, message, or upload the key.

1. If a colleague sends you their .asc file, save it to a location accessible from Termux (e.g., Downloads).
2. Grant Termux access to that folder (if you haven’t already) by running:

   termux-setup-storage

   Accept the permission prompt.
3. Import the key:

   gpg --import /sdcard/Download/contact_key.asc

4. Verify the import by listing keys:

   gpg --list-keys

1. Place the file you want to protect in a known folder, for example /sdcard/Download/secret.txt.
2. Run GPG with the recipient’s email (or key ID) to produce an encrypted output:

   gpg --output /sdcard/Download/secret.txt.gpg \
       --encrypt --recipient contact@example.com /sdcard/Download/secret.txt

3. After the command finishes, you’ll have secret.txt.gpg. The original secret.txt remains unchanged; you may delete it if you no longer need an unencrypted copy.
   Use --armor to create a text‑based .asc file that can be sent via email without binary attachment issues.

1. Assuming you received message.gpg and saved it to /sdcard/Download, decrypt with:

   gpg --output /sdcard/Download/message.txt \
       --decrypt /sdcard/Download/message.gpg

2. GPG will ask for the passphrase of your private key. Enter it; the decrypted content appears in message.txt.
3. If you used the --armor option, the file will have a .asc extension. Decrypt it the same way; GPG automatically detects the format.

1. Some senders may sign a file instead of encrypting it. To verify a signed file report.txt.asc:

   gpg --verify /sdcard/Download/report.txt.asc

2. If the signature is good, you’ll see a message like Good signature from …. A warning indicates a missing or untrusted key.

For frequent encryption, create a tiny shell script in ~/bin (make the folder if it doesn’t exist):

mkdir -p ~/bin
cat > ~/bin/enc <<'EOF'
#!/data/data/com.termux/files/usr/bin/sh
# Usage: enc recipient file
RECIPIENT=$1
FILE=$2
OUT="${FILE}.gpg"
if [ -z "$RECIPIENT" ] || [ -z "$FILE" ]; then
  echo "Usage: enc recipient_email /path/to/file"
  exit 1
fi
gpg --output "$OUT" --encrypt --recipient "$RECIPIENT" "$FILE"
echo "Encrypted to $OUT"
EOF
chmod +x ~/bin/enc

Now you can run:

enc contact@example.com /sdcard/Download/report.pdf

The script saves you from typing the long gpg command each time.