Elba vs GPG: signing and PKI vs a small local fence

At a glance

Two problems that only look alike

GPG's real subject is identity: proving a message came from you, and encrypting it so only a named recipient can read it. Keys, signatures, expiry, revocation, and the web of trust all exist to serve that. Elba has none of it because Elba solves the other problem — a folder on your disk that only you should open.

GPG can do that too, with symmetric mode and a passphrase. It works fine. It is just the narrowest slice of a much larger tool, driven from a command line most people never open twice.

Pick GPG if

You need to send an encrypted file to a specific person. You need to sign something so recipients can verify it came from you. You are scripting encryption in a pipeline. You are working with software releases, package signing, or anything where identity matters. Elba does none of that and never will.

Pick Elba if

The recipient is future-you. There is no correspondent, no key exchange, and no signature to verify — just a folder you want closed. Adding a keyring to that problem is machinery you will have to maintain, back up, and eventually remember the passphrase of anyway.

The key-loss problem cuts both ways

People lose GPG private keys and lose everything encrypted to them. People forget Elba passphrases and lose the folder. Neither tool has a back door. The difference is that GPG asks you to protect a key file and a passphrase, while Elba asks you to protect a passphrase alone. One fewer thing to lose is a real, if unglamorous, advantage.

When GPG is the better choice

Any time a second person is involved. Any time you need to prove authorship. Any time the encryption has to run unattended in a script. GPG is free, ubiquitous, and battle-tested — reach for it without hesitation in those cases.

Why GPG's difficulty is not a joke people make up

There is a well-known body of research on this, going back to the 1999 paper 'Why Johnny Can't Encrypt' and repeated with newer tools since. Capable, motivated users given a good interface still made mistakes that destroyed the security of what they sent — encrypting to the wrong key, sending plaintext by accident, mishandling revocation.

None of that is a criticism of the cryptography, which is excellent. It is an argument that a tool's interface is part of its security, and that removing features can make people safer than adding them.

Symmetric GPG, if you want to compare like with like

The closest GPG equivalent to what Elba does is `gpg --symmetric --cipher-algo AES256 file`. It produces a strong, portable encrypted file with a passphrase and no keyring involved.

For a folder you archive once a year, that is genuinely sufficient and it costs nothing. The reasons to want something else are the tar-first step for folders, the extracted plaintext when you work, and having to remember the command a year later.

Who Elba is for

Elba is for someone who tried `gpg --symmetric`, got it working, and then realised they would have to remember the incantation every time. It is the same job with a door instead of a syntax.

Questions people actually ask

Can GPG encrypt a folder?

Not directly — you tar the folder first, then encrypt the archive. That reintroduces the extract-edit-rearchive problem.

Is GPG more secure than Elba?

Its primitives are excellent and heavily reviewed. Most real-world GPG failures are configuration and key-management mistakes rather than cryptographic ones — which is exactly the surface Elba removes by not having keys.

What's the difference from age?

age is a modern, deliberately minimal replacement for GPG's file-encryption role, without the keyring and trust machinery. If you like the command line, age is often the nicer choice.

Does Elba use public-key cryptography?

No. It derives a key from your passphrase with PBKDF2 and encrypts with AES-256-GCM. There is no key pair.

Can I open Elba files with GPG?

No. The formats are unrelated.

Which should I use to email a file to a lawyer?

GPG, if they have a key. Otherwise a strong-passphrase archive with the password sent by another channel.

Compare Elba with other tools

• Elba vs VeraCrypt: two different jobs, honestly compared
• Elba vs Cryptomator: local folder vs cloud-transparent vault
• Elba vs Boxcryptor (or: what to do now Boxcryptor is gone)
• Elba vs 7-Zip encryption: when a zip is enough (and when it isn't)
• Elba vs BitLocker: disk vs folder, two layers of the same idea
• Elba vs FileVault: macOS full-disk plus folder-level fencing
• Elba vs age: a GUI for the ‘just encrypt this folder’ case
• Elba vs Proton Drive: sync vs sovereign

All guides

Related guides

• Elba vs age: a GUI for the ‘just encrypt this folder’ case

  age is the modern command-line file encryption tool. Elba is a GUI fence around a folder. Different audiences, same seriousness.

• How client-side encryption works, in one page

  Client-side encryption means the key never leaves your device. Here's how it works, why it matters, and how Elba applies it.

• Zero-knowledge encryption, explained without jargon

  Zero-knowledge means the service can't read your files even if it wanted to. Here's the idea, and how Elba goes one further.