Sending Encrypted Emails with aerc

With the email client aerc , you can not only read encrypted emails but also write and send encrypted messages. Prerequisite: the recipient’s public GPG key is available.

Examples and paths refer to macOS. The aerc commands are identical on Linux; only installation (apt/dnf/pacman instead of brew) and config paths (~/.config/aerc/ instead of ~/Library/Preferences/aerc/) differ.

Requirements

#

• aerc is installed (brew install aerc)

• gnupg is installed (brew install gnupg)

• Your own private GPG key is set up (gpg --list-secret-keys)

• You have imported the recipient’s public GPG key:

  gpg --import /path/to/keyfile.asc

Writing an Encrypted Email with aerc

#

1. Start aerc:

   aerc

   If VS Code is your default editor, you’ll need the aerc extension for VS Code. Alternatively, you can launch aerc with a different editor (EDITOR=vim aerc) or set the editor in ~/Library/Preferences/aerc/aerc.conf, e.g. editor=vim.

2. New message with C (Compose). Your configured editor opens.

3. Fill in recipient, subject, and message body (navigate with TAB). When using vim, remember: enter insert mode with i, leave it with ESC. Save and close with :wq.

4. Enable encryption:

   • Sign and encrypt: :pgp sign-encrypt (shortcut: sx)
   • Encrypt only, without signing: :pgp encrypt (shortcut: x)

   Use :attach-key to attach your public key before sending.

5. Send the message: :send (shortcut: y).

   Use :edit -E to edit the entire email before sending (including headers like To, Subject); v shows a preview.

Reading Your Own Sent Messages

#

By default, you can’t decrypt the encrypted emails you send, because they’re only encrypted with the recipient’s key. To make them readable for yourself, add this to ~/.gnupg/gpg.conf:

encrypt-to <your key ID or email address>

Key Trust

#

Before sending, the recipient’s key must be marked as trusted, otherwise GPG refuses to encrypt. Set the trust level:

gpg --edit-key <email>
# Type: trust
# Choose level 4 (full trust) or 5 (ultimate)
# Type: save

You can also sign the key to confirm its authenticity:

gpg --sign-key <email>

Test Run

#

To send an encrypted email to yourself or a second GPG-enabled account:

• Recipient: your own GPG email address
• Make sure your own public key is imported (or generated via gpg --export)

Note on Recipient Keys

#

aerc uses gpg in the background. For a message to be encrypted:

• the recipient’s public key must be available
• the key must be valid and trusted (via gpg --edit-key and trust)

Optional Setup

#

You can automate signing and encryption in ~/Library/Preferences/aerc/accounts.conf:

pgp-auto-sign=true

# Encrypts outgoing emails automatically when all recipients
# (incl. Cc and Bcc) have a public key in the keyring.
pgp-opportunistic-encrypt=true

More config options can be found in the manpages aerc-config(5) and aerc-accounts(5).

If you work with multiple keys or want to test, you can set the GPG identity directly in compose mode via :pgp setkey <email>.

Acknowledgments

#

• aerc - terminal-based email client
• GnuPG - GNU Privacy Guard, free OpenPGP implementation
• Homebrew - macOS package manager