Using an external PGP key (e.g. YubiKey) in Thunderbird Mail

This article applies to the desktop versions of Thunderbird Mail. To use a PGP key on Thunderbird for Android, you’ll need OpenKeychain, which you can install from the app’s settings.

1. Click the Settings button in the bottom left.
2. Select the General tab on the side, then click the Config Editor button at the bottom.
3. Dismiss the warning if it appears.
4. Set the mail.openpgp.allow_external_gnupg key to True.
5. Set the mail.openpgp.fetch_pubkeys_from_gnupg key to True.
6. Go back to settings, but this time move the button at the bottom from Thunderbird Settings to Account Settings.
7. Go to the email account you want to configure, and select the End-to-End Encryption tab.
8. Click Add Key.
9. In the menu that appears, choose Use an external GnuPG key (<...>), then click Continue.
10. Enter your Key ID here.

To find your Key ID, run gpg --list-secret-keys in a terminal. You’ll get output similar to this:

cinar@fedora:~$ gpg --list-secret-keys
/home/cinar/.gnupg/pubring.kbx
------------------------------
sec>  ed25519 2025-••-•• [SC] [expires: 2026-••-••]
      B755DA9302198B18161C61093BA6D7F94FC2F731
      Card serial no. = 00•• ••••••••
uid           [ultimate] Çınar •••• ••••• <•••••@••••••••••.•••>
ssb>  ed25519 2025-••-•• [A]
ssb>  cv25519 2025-••-•• [E]

cinar@fedora:~$

The last 16 characters of your key fingerprint are your Key ID. For example, in the output above, the last 16 characters of B755DA9302198B18161C61093BA6D7F94FC2F731 (i.e. 3BA6D7F94FC2F731) are my Key ID.

(If you’re using a device like a YubiKey, you’ll need to have introduced it to gpg beforehand — i.e. created a key stub for it. I honestly don’t remember how that’s done.) Enter this into Thunderbird carefully, since there’s no input validation.

11. Click Save Key ID.
12. You should now be able to encrypt and sign messages.