Enigmail makes encrypting e-mail easy

Jack Wallen discovers Enigmail, a simple solution for email encryption. He is confident that, with more applications like this, Linux will lose the stigma of being too difficult to use. Do you agree? Read on.

Have you ever had to encrypt the text of an e-mail? I often do and the process was often a task I'd rather not have to do over and over. Here's how I used to do it:

  • Open up a terminal.
  • Write the e-mail using Nano.
  • Save the file.
  • Encrypt the file.
  • Compose the e-mail and add the encrypted file.
  • Send the file off.
  • Rest my fingers.
  • Wash, rinse, repeat.

I did that for years until I came across the Thunderbird extension Enigmail. This extension allows for simple encryption and signing of e-mails such that the process of encrypting and signing an e-mail is as quick as the click of a menu entry.  You can even have Enigmail set up to automatically encrypt and/or sign all outgoing e-mail.

And like any Thunderbird (or Firefox) extension, Enigmail is easy to install. Download the Enigmail install file, open up the Add-ons window, click Install, browse for the Enigmail installer, and click the Install button (after the timer counts down.) You will have to restart Thunderbird to finalize the process. Once Enigmail is installed, you will notice a new menu entry in Thunderbird: OpenPGP.

Enigmail also has a built in key management system that allows you to manually manage keys and automatically import keys (from attachments or from key servers).

This extension works with OpenPGP 2.0.x and 1.4.x and supports Mozilla's Multiple Identities. It's easy to install and even easier to use. And, with the help of Enigmail, you can even generate your key pair without having to touch the command line! This last feature, in and of itself, makes Enigmail a perfect encryption solution for Linux. Why? Because new users can enjoy the benefit of encrypted e-mail without having to touch the command line.

What I would like to see is more outstanding features like this to tightly integrate Thunderbird and Firefox into Linux while making various processes much easier. Prior to using Enigmail, if someone came to me asking how to encrypt e-mail, I would sit them down and walk them through the process. It wasn't easy at times. Now I simply tell them to install OpenPGP and Enigmail and the rest is easy.

That's more like it. If Linux continues enjoying applications such as this, newbies will become old-hatters much faster.


Jack Wallen is an award-winning writer for TechRepublic and He’s an avid promoter of open source and the voice of The Android Expert. For more news about Jack Wallen, visit his website


The problem preventing adoption of encrypted email is not Linux. It's not even that Enigmail (which is also works very well on Windows, by the way) is too difficult to use (it isn't -- it is every bit as easy as you say it is). The problem is that the people who click spam and install trojans and forward jokes that have been circulating online for the past 20 years are the same people who refuse to use encryption because they don't see the point of it. These are not just grandmothers and old men who wear hats when they drive -- these are CIOs and managers and small business owners. The problem, in short, is that people are stupid.


Nice writeup, thanks.


So many times I have tried to get people to secure their communications, without success. I have received *confidential* information on my inbox that should have been strongly encrypted, yet was there for everyone to see. Some of that information was related to my person or family, some was professional, some was financial, some was legal, some was security sensitive. Banks sending account statements, lawyers sending confidential information, accountants sending financial reports, clients sending server passwords, etc. The cure to ignorance is knowledge. The cure to stupidity is evolution.


It's a pretty sad situation. My wife's company tried to implement a PGP encryption scheme (a pretty decent one I thought) and they scrapped it because of user backlash. Outrage over an additional click or somesuch. And every time I get an unsigned email from a bank or credit card company I want to scream. I've taken to forwarding those to their (probably /dev/null) anti-phishing departments. Surely a valid e-mail would be signed, right? Maybe someday they'll get the message.

Neon Samurai
Neon Samurai

Banks not using signed email, websites not using https login forms.. I wish it was a unique problem. I cringe every time I have to spray my username and password across the network; even if it is a site specific one.


That's another one, though I see it less often. But is one major player that does it. Thanks for the reminder, I need to complain to them about that. Inexcusable.

Editor's Picks