GnuPG (also known as GPG) is a complete and free implementation of the OpenPGP (RFC4880) standard and allows you to secure your data and communication flows.
Its having a command line tool with features for easy integration with other applications, libraries and also provides support for S/MIME and ssh.

What you can do with GPG?

GPG allows you to do couple of things:

  • sign things to prove to other people.
  • verify things that have been signed by other people.
  • encrypt/decrypt things to limit who can access.

In general GPG is trying to give users a secure encrypted channel that permits people to communicate with considerable confidence that others (including big unnamed government agencies) cannot eavesdrop, even if the encrypted traffic is intercepted.

Digital signatures are useful for verifying that all parties see the same file contents.

Universal Crypto Engine

GPG is a command line tool without any graphical user interfaces. It is an universal crypto engine which can be used directly from a command line prompt, from shell scripts, or from other programs. Super useful for creating secure ways of propagating sensitive variables (like passwords, API keys, other secrets) Therefore GnuPG is often used as the actual crypto backend of other applications.

Over the years, GnuPG has widely gained in popularity to become the standard as free software for private communication and digital signature.
You can find many applications and software that supports GPG encryption and this number is growing.

Public-Key Cryptography

In short, public-key cryptography solves the age-old problem "how do I communicate with someone securely without exchanging a secret password first?"

Exchanging a shared password securely is a big problem and you may have no way to do so if your communications are monitored.

With public-key encryption, instead of sharing a password, each party generates a "keypair" consisting of a "public" key and a "secret/private" key. Each party can then publish their "public" key to the world or send it directly to the other party, while keeping their secret key private and safe.

gpg or gpg2?

gpg (version 1) is more tested, and is usually a single monolithic executable.
gpg2 (version 2) is compiled with crypto libraries like libgcrypt and is designed to work better with external password entry tools. Both are very compatible with each other.

From 2017 gpg2 contains elliptic-curve algorithms for generating and importing public keys and those are not contained in gpg.