Products · Product
GPG
Raised as a usability problem by 307 people on Hacker News over 19 years (2008–2026), in 251 threads.
No issue was raised by at least 3 people in 3 threads this year.
- 1Key management is hard for usersUnreviewed
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13User documentation is confusingUnreviewed
- 14
- 15
Every issue, all time, most people first
Key management is hard for usersUnreviewed
20082026- Finding and verifying keys is hard; revocation certs are easy to miss and users can't be sure of keys2023-12-09
- Creating and managing keys is a very bad user experience2021-10-12
- Users must maintain keys and encrypt or decrypt each message, which is laughably bad UX2021-09-11
Users cannot tell why emails fail to decryptUnreviewed
20082026- Encryption is cumbersome in the mail client, so users ignore or disable it2021-05-17
- Nearly impossible for ordinary users to send encrypted email even with the client configured2020-05-28
- Commenter says encrypted email is basically impossible to send even with the client set up2020-05-28
Verifying keys requires manually tracking trust paths and importing keysUnreviewed
20082026- Finding trust paths to unknown developers' keys requires huge manual effort and bloats the keyring2025-12-27
- Verifying a developer's key needs manual multi-step trust-path hunting that the software doesn't support2023-11-10
- No tool to check whether a trust path exists to a key2023-05-21
Web of trust signing is unusable for non-technical peopleUnreviewed
20082026- Horrible user experience and high entry barrier make web of trust fail2026-06-02
- Web of trust is confusing; 'trusted' label invites dangerous misinterpretation of signing2021-12-28
- Web of trust signing is utterly unusable for non-technical people2019-03-13
YubiKey setup is complicated and GPG often fails to find the keyUnreviewed
20082026- SSH-key signing with Yubikeys doesn't just work, needs ssh-agent setup2025-11-14
- Easy to leave insecure config when importing generated keys to a Yubikey2019-11-05
- Setting up GPG with a YubiKey is complicated and GPG often fails to find the key2019-07-17
Commit signing with ssh-agent is a nightmare to set upUnreviewed
20082026- Setting up GPG with ssh-agent for commit signing was a nightmare on every OS2022-09-14
- Gpg-agent and OpenSSH don't work together on Windows, forcing awkward workarounds2019-04-04
- Setting up gpg-agent for SSH needs many manual config file edits on Ubuntu Gnome2019-04-03
Unclear what a key means, so people get into troubleUnreviewed
20082026- Protocol is confusing; unclear what a "key" means, so people get into trouble2018-09-18
- Setting up keys requires learning public key cryptography concepts and takes effort2016-03-25
- Confusing key type choices and multi-step setup make getting a key hard for ordinary users2015-02-25
Key management needs a tutorial lookup due to counterintuitive commandsUnreviewed
20082026- Users must look up commands to fetch keys and verify every time2025-01-04
- Key management needs a tutorial lookup every time due to counterintuitive commands2016-04-06
- Users must run command line tools to generate and keep keys2015-02-25
Crypto API is easy for non-experts to misuseUnreviewed
20082026- GPG's crypto API is terrible and easy for non-experts to misuse2017-08-21
- Users couldn't figure out GPG tools, so the author built a hacky script to hide encryption2015-02-25
- Public/private key encryption is hard to understand and its GPG interface is user-hostile2013-06-25
Calling gpg as a subprocess is slow, fiddly to parse and awkwardUnreviewed
20082026- Calling the gpg tool as a subprocess is slow, fiddly to parse, and awkward for apps to use2024-04-07
- Simple tasks require running gpg and parsing its output, which is painful and slow2023-11-10
- Complicated, with a weird naming scheme and multiple confusing programs (gpg vs gpg2)2018-04-01
Journalist could not figure out how to use PGP aloneUnreviewed
20082026- Author failed three times to get PGP working and gave up2024-10-17
- Inventor couldn't figure out how to make PGP work on his Mac2023-03-17
- Journalist could not figure out how to use PGP on his own2015-08-14
Keyrings are cumbersome and error-prone to manageUnreviewed
20082026- Keyrings and 32-bit key IDs make it awkward to use for automated decryption and verification2025-12-28
- Keyring keeps breaking, forcing repopulation, keyserver changes, or manual deletion2022-08-17
- Keyrings are cumbersome and error prone, forcing users to deal with them2021-06-08
User documentation is confusingUnreviewed
20082026- Documentation is hard to read and the tool feels less usable than signify2025-04-09
- Too much documentation to wade through to do a simple task2021-08-24
- User documentation is confusing, and the tool is inherently hard to use2018-08-06
Users set long key expirations or stop using PGP after expired-key errorsUnreviewed
20082026- Renewing subkeys every year or two is stressful because gnupg2 is user-hostile2025-11-27
- Renewing GPG keys is a nightmare, and an expired master key cannot be renewed.2023-09-15
- Users don't properly rotate keys, so they set long expirations or stop using PGP after an expired-key error2021-11-13
Two confusing trust questions must be answeredUnreviewed
20082026- Users must answer two confusing trust questions, worsening the user experience2020-06-09
- Users click through trust dialogs without understanding the web of trust2011-08-29
- Trust reduced to an integer value that doesn't match how users think2011-04-20
Unreviewed issues were grouped by machine: Claude Haiku labelled each comment as a usability complaint, named what it's about and summed up the problem in a line, and a small model grouped similar problems. Nobody has checked them by hand. Expect mistakes.
The newest 50 complaints
- Making tooling for PGP is nearly impossible; anything beyond the binary is painful2026-10-16
- Users unknowingly make keys certificate authorities when raising trust levels to clear warnings2026-10-16
- PGP identities are files, which people today don't understand how to handle2026-10-15
- Encrypting each message requires going to the CLI, so the author stops encrypting2026-07-07
- Horrible user experience and high entry barrier make web of trust fail2026-06-02
- PGP's UX makes it comically easy to screw up and hard to adopt2026-05-28
- Very few people use PGP/GPG because its user experience is hard2026-03-06
- Even technical users struggled to get PGP set up correctly2026-01-20
- Is overly complicated and horrible to use2026-01-04
- Post says GPG has bad UX that makes it easy to misuse2026-01-04
- Keyrings and 32-bit key IDs make it awkward to use for automated decryption and verification2025-12-28
- Finding trust paths to unknown developers' keys requires huge manual effort and bloats the keyring2025-12-27
- Renewing subkeys every year or two is stressful because gnupg2 is user-hostile2025-11-27
- Pinentry prompt fails every time when gpg2 is called from GUI apps on BSD2025-11-14
- SSH-key signing with Yubikeys doesn't just work, needs ssh-agent setup2025-11-14
- Described as a shit show stuck in the 90s, with no specific operation named2025-11-13
- Arcane user experience gets in the way and gatekeeps privacy use2025-10-30
- PGP clients have unfortunate UX, so key setup and use is too complicated for most people2025-10-14
- Workflow is too opaque and requires specialized knowledge most people lack2025-08-29
- Fetching keys and verifying the right key is awkward; packages failed to update due to missing key2025-05-10
- Fatal errors where plain gpg only gives a warning, making it harder to debug2025-04-18
- Documentation is hard to read and the tool feels less usable than signify2025-04-09
- Commit signing with pinentry, gnupg and git has issues on OpenBSD2025-04-07
- Users must look up commands to fetch keys and verify every time2025-01-04
- Confusing to use, and tries to do too many things2024-12-26
- GPG is so annoying to use that the commenter avoids it2024-11-20
- Hard UX makes PGP prone to user errors2024-11-17
- Author failed three times to get PGP working and gave up2024-10-17
- GPG is hard to learn, and people aren't taught how to use it2024-10-17
- Tons of footguns make it easy to make dangerous mistakes2024-08-05
- Six or seven trust levels for contacts are too complicated for people to maintain2024-07-21
- Ease of use and user experience are poor, difficult even for developers2024-05-06
- GPG is completely unusable for normal people2024-04-11
- Calling the gpg tool as a subprocess is slow, fiddly to parse, and awkward for apps to use2024-04-07
- PGP is cumbersome to use, so people avoid encryption2024-04-03
- Key management is an obstacle that keeps ordinary people from using PGP2024-01-22
- Its design is too stateful, making it hard to reproduce results2024-01-20
- Finding and verifying keys is hard; revocation certs are easy to miss and users can't be sure of keys2023-12-09
- Setting up PGP on Android is hard and key generation and rotation is frustrating2023-12-07
- Hard to discover someone's encryption key and keep keys synced across devices2023-12-05
- Cryptographic signing is hard to use, with a terrible user experience2023-12-02
- Verifying a developer's key needs manual multi-step trust-path hunting that the software doesn't support2023-11-10
- Simple tasks require running gpg and parsing its output, which is painful and slow2023-11-10
- PGP has such awful usability that few people can use it2023-10-17
- Renewing GPG keys is a nightmare, and an expired master key cannot be renewed.2023-09-15
- Requires explicit expert knowledge to use correctly, so people find it a hassle2023-06-01
- PGP/GPG has a terrible user interface2023-05-23
- Still struggles to use PGP even after long experience with it2023-05-22
- GnuPG supports only one keyserver at a time, making discovery of keys annoying2023-05-21
- Hard to build new tools on it; awkward workarounds and slow startup2023-05-21