Welcome back to LaunchCrafted! Today, let’s tackle a security issue that makes me cringe every time I see it: sharing credentials in direct messages or group chats. Whether it’s on Slack, Teams, or Skype, firing off secrets and passwords in these channels is a massive risk. These platforms can be hacked, or maybe they don’t fully encrypt data, or perhaps employees at the company have more access than you realize. And group chats? Don’t even get me started—one accidental invite or rogue group member can compromise everything.

We often hear excuses like:

“No, this credential is just for a dev environment…”
“It’s only trusted people here…”

But credential leaks can lead to gigantic repercussions—think lost revenue, brand damage, or plain old identity theft. Let’s not wait for regrets to set in.

Enter GPG: Your New Secret-Sharing Sidekick

If you haven’t heard of it, GPG (GNU Privacy Guard) is an industry-standard tool for encryption and signing. In short, it lets you encrypt files and messages so only the intended recipient can read them. Even if someone snoops on the data in transit, it’s worthless to them without the proper key.

In this post, I’ll show you how to set up GPG on macOS, Windows, and Linux. Then we’ll walk through how to generate your key pair and share credentials securely.

1. Installing GPG

macOS

1. Install via Homebrew (Recommended):

   • If you don’t have Homebrew installed, open Terminal and run:

     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

   • Once Homebrew is set up, install GPG:

     brew install gnupg

   • Verify installation:

     gpg --version

2. Alternatively, use GPGTools:

   • Download GPGTools and install it.

   • This package includes a suite of GPG utilities and a convenient GUI.

Windows

1. Download Gpg4win:

   • Head to Gpg4win and download the installer.

   • Run the installer and select the components you want (usually GnuPG and Kleopatra).

2. Kleopatra (GUI):

   • Kleopatra is a user-friendly interface for managing keys and encrypting/decrypting files.

   • After installing, open Kleopatra to create and manage your keys.

Linux (Ubuntu/Debian-based)

1. Install via apt:

   sudo apt update sudo apt install gnupg

2. Other Distributions:

   • For Fedora, use dnf install gnupg.

   • For Arch, use pacman -S gnupg.

   • Verify installation:

     gpg --version

2. Generating Your Key Pair

Once GPG is installed, the next step is creating your personal key pair consisting of:

• A public key (you share this with others).

• A private key (this stays locked down on your machine—never share it).

Generate a Key Pair

Open your terminal (or Kleopatra on Windows) and run:

gpg --full-generate-key

You’ll be guided through a series of prompts:

1. Key Type: Typically choose RSA and RSA (default) or ECC.

2. Key Size: For RSA, 4096 bits is a good modern standard.

3. Expiry Date: You can set an expiration date (1-2 years) or choose “no expiration.”

4. Real Name: Enter your name.

5. Email Address: Provide an email you’d like associated with the key.

6. Comment: Optional but can be useful to add a note or label (e.g., “Work key”).

7. Passphrase: Use a strong, unique passphrase for your private key.

After this, GPG will generate your keys. It may ask you to do some random actions if it needs more “entropy” (randomness).

List Your Keys

To list your keys, run:

gpg --list-keys

You should see your newly created public key listed. To see your private key, run:

gpg --list-secret-keys

3. Sharing Your Public Key

For someone else to send you encrypted messages (or for you to verify something you’ve signed), they need your public key.

• Export your public key:

  gpg --armor --export your.email@example.com > my_public_key.asc

  This creates a text file (.asc) that you can share via email, Slack, or any channel (public key is safe to distribute).

• Someone can then import it:

  gpg --import my_public_key.asc

4. Encrypting and Decrypting Files/Messages

Encrypting a File

Suppose you have a file named credentials.txt that you want to share with a colleague who has the public key under the email colleague@example.com.

gpg --encrypt --recipient colleague@example.com credentials.txt

GPG will generate credentials.txt.gpg. This is the encrypted file that you can safely share.

Decrypting a File

On the receiving end, once your colleague downloads credentials.txt.gpg, they can decrypt it like so:

gpg --decrypt credentials.txt.gpg > credentials_decrypted.txt

They’ll be prompted for their private key passphrase. After that, GPG outputs the decrypted content into credentials_decrypted.txt.

Encrypting Text Directly (No Files)

Want to send a quick message in Slack but in an encrypted form? You can type it out in Terminal:

echo "Here is a secret password: MySuperPassword123" | gpg --armor --encrypt --recipient colleague@example.com

GPG will spit out encrypted text like:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2 hQEMA9kTMQro0owtAQf9HvvMYJDrWhf1V2NTTLkaCeCazOQZ5N/9s0BYUzFBzN/9
[...] 
-----END PGP MESSAGE-----

Copy/paste that into Slack, Teams, or email—wherever.

Decrypting (No File Needed)

When your colleague receives that block of text, they can decrypt it straight from the command line without creating a file, printing directly to the terminal:

echo "-----BEGIN PGP MESSAGE----- 
Version: GnuPG v2 hQEMA9kTMQro0owtAQf9HvvMYJDrWhf1V2NTTLkaCeC...
[...] 
-----END PGP MESSAGE-----" | gpg --decrypt

They’ll be prompted for their private key’s passphrase (if required), and the decrypted message will appear directly in their terminal output.

Decrypting to a File

If your colleague wants to save the decrypted output to a file, they can redirect the output:

echo "-----BEGIN PGP MESSAGE-----
Version: GnuPG v2 hQEMA9kTMQro0owtAQf9HvvMYJDrWhf1V2NTTLkaCeC...
[...]
-----END PGP MESSAGE-----" | gpg --decrypt > decrypted_message.txt

After entering the passphrase, the decrypted content will be stored in decrypted_message.txt.

5. Best Practices & Tips

1. Keep your private key private. Never share it with anyone.

2. Use a strong passphrase. Protects your key even if someone gains access to your computer.

3. Verify your key fingerprints. When exchanging public keys with someone, confirm the key’s fingerprint over a secure channel or in person to avoid “man-in-the-middle” attacks.

4. Rotate or revoke keys when needed. If you suspect any compromise, revoke the key and generate a new pair.

5. Automate if possible. For frequent encryption tasks, consider scripts or tools that wrap around GPG. That way, your team can standardize this process.

The Bottom Line

Sharing credentials in group chats or direct messages is a recipe for disaster—no matter how secure or “friendly” the environment may seem. Using GPG to encrypt your secrets is a simple, robust way to protect your data and your organization. You might spend a bit more time setting up keys, but that investment pays off the moment you avoid even one serious security breach.

I’d love to hear from you:

• Have you tried using GPG or any other encryption methods before?

• What are your tips for keeping credentials safe?

Drop your thoughts or questions below, and let’s make the tech world a safer place—one encrypted message at a time!

Thanks for reading, and stay secure!
Mortaza

Hi there! 👋

If you’re a tech enthusiast, software engineer, architect, or someone curious about startups and the tech world, you’re in the right place. Welcome to LaunchCrafted!

I’ve been working in the tech industry for the past 8-9 years, and during this time, I’ve worn many hats: backend engineer, cloud engineer, team lead, and even startup founder. Along the way, I’ve faced plenty of challenges, learned a lot, and grown both professionally and personally.

This newsletter is my way of sharing those lessons with you—whether you’re building your first app, leading a team, or just trying to navigate the ever-changing tech world.

A Quick Intro: My Story

A few years into my tech career, I decided to start my own company. I launched a startup that became one of the most loved mobile apps in my home country. For 4-5 years, I poured my heart into that project, learning everything from:

• Team leading and building a great product,

• Backend and mobile development,

• Software architecture design,

• Scrum mastering and managing workflows,

• Marketing and B2B negotiations,

• And much more!

Eventually, I handed the startup over to another company (it wasn’t a typical sale, but let’s call it that for simplicity). Around that time, I decided to move to a place with better opportunities and a stronger economy.

Now, I live and work in the Isle of Man, part of the United Kingdom. I’ve been focusing on backend development, cloud engineering, and occasionally leading teams.

Why LaunchCrafted?

A few months ago, I started a YouTube channel to share my knowledge about tech and startups. While I enjoyed it, I realized that creating videos is incredibly time-consuming. Writing, on the other hand, feels much more natural to me.

That’s why I decided to launch this newsletter. Here, I can share my thoughts, guides, and experiences without worrying about lights, cameras, or editing.

With LaunchCrafted, my goal is simple:
To provide practical, actionable insights for anyone interested in tech or startups.

What to Expect

Here’s what I plan to write about:

• Tech guides: Tips on cloud configuration, software development, productivity, and more.

• Startup challenges: Lessons I’ve learned from running a startup, from handling B2B negotiations to marketing strategies.

• Industry insights: My thoughts on trends and challenges in tech and startups.

I’ll aim to keep things simple and beginner-friendly while still providing value for experienced readers.

This newsletter is for everyone who wants to learn, grow, and navigate the exciting world of tech and startups.

Join the Journey

If this sounds interesting to you, hit the subscribe button and join me on this journey. I’d also love to hear from you—your thoughts, questions, or suggestions for topics. Let’s make LaunchCrafted a space where we can all learn and grow together.

Thanks for reading, and welcome aboard!

Cheers,
Mortaza