About PGP
PGP (Pretty Good Privacy, standardised as OpenPGP) encrypts data with a pair of keys: a public key you can hand to anyone, and a private key that stays with you, protected by a passphrase. What is encrypted with the public key can only be decrypted with the matching private key.
Gravity Forms PGP Encryption only ever needs your public key. When a visitor submits a form, the plugin encrypts the notification with that key on your server, and only the holder of the private key can read the email.
No key pair yet? Create one with our in-browser generator, or with any of the tools below.
Software to read encrypted mail
| Software | Runs on | Notes |
|---|---|---|
| Thunderbird | Windows, macOS, Linux | OpenPGP built in since version 78. |
| Mailvelope | Browser extension | Read PGP mail in Gmail, Outlook.com and other webmails. |
| Gpg4win (Kleopatra) | Windows | Includes an Outlook add-in. |
| GPG Suite | macOS | Integrates with Apple Mail. |
| GnuPG | Windows, macOS, Linux | The command-line reference implementation. |
| Proton Mail | Web, mobile | Import your key pair, or use its address key as the recipient key. |
The quickest start for webmail users is Mailvelope; on the desktop, Thunderbird needs no add-on.
Plugin FAQ
What does the plugin do?
It encrypts Gravity Forms notification emails with the recipient's PGP public key, so form submissions reach the inbox as PGP messages. Your visitors do nothing special.
What are the requirements?
WordPress 5.0 or later, PHP 7.3 or later (PHP 8.x supported) and Gravity Forms, any license.
Can I send to several recipients?
Yes. Add each recipient's public key under PGP Public Keys, then create one notification per address. Each notification is encrypted with the key whose email matches its recipient.
Can I encrypt uploaded files?
Yes. With attachment encryption enabled (the default), each uploaded file is encrypted separately and attached as a
.pgp file.
Can I keep submissions out of the WordPress database?
Yes. Under PGP Public Keys → Settings, choose the forms whose entries are deleted once the notification has been sent.
Does it support PGP/MIME?
No. Notifications are sent as plain-text emails whose body is an ASCII-armored PGP message, which every OpenPGP tool reads.
Is the plugin secure? Can I check it?
The plugin is readable PHP: no binaries, no remote service, nothing sent anywhere in clear by the plugin. Encryption happens on your own server with the OpenPGP-PHP library. Serve your site over HTTPS so submissions are also protected between the visitor and your server.
Is it HIPAA or GDPR compliant?
Compliance depends on your whole setup and processes, not on one plugin, so we do not certify it. The plugin helps by keeping form data encrypted in email and, if you choose, out of your database.
What happens if I do not renew?
The plugin keeps working. You stop receiving updates and support until you renew.
Troubleshooting
Notifications arrive unencrypted
Check that the notification subject contains [encrypted] and that a public key exists whose email is
exactly the notification's recipient address.
Notifications arrive as HTML and will not decrypt cleanly
Under PGP Public Keys → Settings, switch that form's notifications to plain text.
No email arrives at all
That is a mail delivery issue on the WordPress side. Configure an SMTP or transactional mail plugin (such as WP Mail SMTP) and send yourself a test email first.
I forgot my key's passphrase
Nobody can recover it, including us: we never see your keys. Create a new key pair and replace the public key in the plugin.
I lost my download link or license key
Open your account with the email used for the purchase: your keys and downloads are there.
Still stuck?
Email [email protected] with your WordPress, PHP and plugin versions and a screenshot of the error. Never send us a private key.