PGP File Encryption for Beginners — Encrypt Messages on Windows/Mac/Linux
Last month, a buyer on Nexus Market pasted his full shipping address into an unencrypted order note. The vendor’s automated system logged it, the market’s database got scraped during a leak, and within two weeks he received a suspicious package follow-up letter from a postal inspector. PGP would have taken him ten minutes to set up and would have kept that address readable only to the vendor’s private key. This is the gap most beginners fall into: they assume the market’s built-in messaging is enough, then discover too late that “encrypted on the server” means nothing if the server gets popped.
Pretty Good Privacy (PGP) is asymmetric cryptography: you generate two mathematically linked keys, a public key you share with anyone (vendors, markets, contacts) and a private key you never upload anywhere. When someone encrypts a message with your public key, only your private key can decrypt it. When you encrypt a message to a vendor’s public key, only their private key can read it. This is why every serious market — DarkMatter, DrugHub, Nexus, Torzon — enforces PGP for shipping addresses and 2FA login codes.
The common mistake I see is people treating PGP like a password manager field. They generate a key, paste it into their profile, and never use it again until the market demands it. The real workflow is: encrypt every sensitive string before it leaves your machine, decrypt incoming messages locally, and never let plaintext addresses touch a server. A 2018 netnographic study of dark net ecosystems found that resilient marketplaces survive law enforcement pressure precisely because their users adopt these layered habits — PGP being one of the oldest and most reliable layers.
You need a clean machine (Tails, Whonix, or a hardened Linux/Windows/Mac install), a strong passphrase manager or a memorized 20+ character passphrase, and about 30 minutes of uninterrupted time. Do not generate keys on a shared computer, on a work laptop with endpoint monitoring, or inside a VM that snapshots to cloud storage — your private key will leak.
Download GnuPG (GPG) from the official site or your OS package manager. On Windows, install Gpg4win 4.3.0 or newer (includes Kleopatra, a graphical frontend). On macOS, install GPG Suite 2024.2 or use Homebrew with `brew install gnupg`. On Linux, `sudo apt install gpg` or the equivalent for your distro. Verify the download signature if you can — this is the one step most beginners skip, and it’s the one that catches tampered installers.
Open a terminal (or Kleopatra on Windows) and run `gpg –full-generate-key`. Choose RSA and RSA, set the key size to 4096 bits (the minimum recommended for current threat models), and pick a 1-year expiration. When prompted for Real Name and Email, use a handle that does not match any real identity — your darknet alias only, no Gmail address. Comment field can stay blank.
The passphrase is the single point of failure. Use a unique 20+ character string with mixed case, numbers, and symbols. A diceware-style phrase like `cactus-bridge-7-quartz-Vector` is stronger than `P@ssw0rd!` and easier to remember. If you lose this passphrase, your private key becomes a useless file — there is no recovery. Write it on paper, store the paper in two physical locations, and never type it on a keyboard while screen-sharing or over remote desktop.
| Torzon Market |
torzon7aphar3x4l5b77nsylgyw26kntbi4m2wemrjh72aczeh27f6qd.onion
|
| Omega Market |
omega7yhz7n4vg4yhf2na2qaaaeatdlqvjbj2juc245mr5muxtnuvgyd.onion
|
| BlackOps |
blackoogcnxogvymmebfwfjhx4k7efpgeoeytxtsev2lc4pqlbz54qad.onion
|
| Nexus |
nexusbem4wmo67jt723niftkejivtgxbsbxkb6aesj5gyzj7b3v3mxid.onion
|
| DrugHub |
drughuj7l72ig56pza77eriu7yh6qsao4xb4yasq2qfjusxzuq6rlwqd.onion
|
Export your public key with `gpg –armor –export your@alias.onion > mypubkey.asc`. This `.asc` file is what you paste into market profile fields and send to vendors. Export your private key with `gpg –armor –export-secret-keys your@alias.onion > myprivatekey.asc` and store this file on at least two encrypted USB drives kept in separate places. Never email it to yourself, never store it in cloud sync folders, never paste it into a chat window.
Generate a revocation certificate immediately: `gpg –gen-revoke your@alias.onion > revoke.asc`. This lets you invalidate the key if your private key is ever compromised. Save it offline, label it clearly, and forget where it is until you need it — that’s the point.
To encrypt a message to a vendor, first import their public key (paste it into Kleopatra or run `gpg –import vendor.asc`), then encrypt: `gpg –armor –encrypt –recipient vendor@alias.onion message.txt`. The output is a block of ASCII you paste into the market’s message box. To decrypt an incoming message, copy the encrypted block, run `gpg –decrypt`, paste the block, press Ctrl+D, and enter your passphrase.
On Windows with Kleopatra, the Notepad plugin lets you select text, right-click, and encrypt/decrypt without touching the terminal. On macOS, GPG Services adds the same to Finder and Mail. Pick whichever interface you will actually use — the best tool is the one you don’t avoid.
Test the round trip before you trust it: encrypt a message to your own public key, decrypt it, confirm the output matches the input. If decryption fails with “no secret key,” you imported the public key but not the private one. If it fails with “decryption failed,” your passphrase is wrong or the key file is corrupted — restore from backup.
Three mistakes I see weekly: (1) encrypting to the wrong key because the vendor’s profile lists multiple keys and the user picked the oldest one, (2) pasting the private key into a market’s “PGP key” field instead of the public key, and (3) forgetting the key expiration date and losing access mid-order. Set calendar reminders 30 days before expiration and generate a fresh key with a transition overlap.
| Scam Type | How It Works | Red Flags | How to Avoid |
|---|---|---|---|
| Fake PGP tool site | Phishing domain offers a “PGP encryptor” that logs your private key | URL off by one letter, no HTTPS, demands private key import | Only use Gpg4win, GPG Suite, or official gpgtools.org builds |
| Vendor key swap | Scammer edits market profile to a key they control, reads your address | Vendor asks you to re-encrypt “to new key,” profile key changed recently | Verify vendor’s key fingerprint out-of-band before re-encrypting |
| Clipboard logger | Malware captures plaintext after you decrypt | Decrypted text appears in unexpected apps, browser extensions request clipboard | Decrypt only on Tails/Whonix, disable browser clipboard access |
Keep your private key on an encrypted volume (VeraCrypt, LUKS, or FileVault) and never decrypt it on a machine connected to your real identity. Rotate keys every 12-18 months. Use subkeys for daily work and keep the master key offline. And remember: PGP protects the message, not the metadata — who you message, when, and how often is still visible to anyone watching the network. Pair PGP with Tor and disciplined OPSEC, and you have the baseline every serious operator relies on.