GPG recryption, also known as re-encryption or re-keying, decrypts a file and immediately re-encrypts it using a different key. This process keeps files encrypted at rest while allowing secure access for other processes that use a new encryption key.

At no point is the unencrypted version of a file ever stored or visible. Files.com decrypts and re-encrypts the file entirely within temporary system memory, where the clear content exists only for the duration of the operation. The unencrypted data is never written to disk, does not persist in memory after processing, and is never accessible to Files.com employees or any other party.

Files.com administrators can enable GPG recryption on a per-folder basis. When enabled for a folder, any files uploaded to that folder or its subfolders are automatically decrypted and re-encrypted, unless you explicitly disable the setting in a subfolder.

Recryption requires a GPG/PGP private key for decryption and one or more GPG/PGP key pairs for re-encryption. You can use different keys for each folder and select multiple public keys for re-encryption. Files uploaded to these folders are decrypted using the private key and then re-encrypted using the selected public keys. You can also choose to sign the re-encrypted file.

If Files.com cannot decrypt a file with the chosen private key, the file remains unchanged. Only files encrypted with a matching public key can be decrypted. Files encrypted with expired public keys cannot be decrypted.

To prevent unencrypted files from being uploaded to a recryption folder, enable the Limit uploaded files to certain extensions folder setting to allow only .pgp or .gpg files.

When you enable GPG recryption, files that existed in the folder beforehand remain unchanged. To apply re-encryption to those files, re-upload them after enabling the setting.

Using Existing Keys From the GPG Key Manager

Select one or more decryption and encryption keys from the available key list. You can optionally select a signing key.

Choose an output format: Binary (default) or ASCII Armor if you need text encoding.

You may also enable the Ignore MDC integrity check option to bypass any modification detection code errors.

Providing Your Own Keys

Select Import from file... when choosing keys.

Enter a name to identify the key or key pair.

If the private key has a passphrase, enter it. You can leave the field blank if there is no passphrase.

Creating New Keys

Select Create new... when choosing keys.

Enter a name and email address for the new key.

Optionally, add a passphrase to protect the private key.

After generating the key pair, you can view and copy the public key before continuing.

Once saved, a popup will display the private key. Download and store it securely.

GPG Signing

You can choose to sign re-encrypted files. Select, import, or create a signing key in the same way you choose decryption and encryption keys.

Signing requires a private key. Public keys cannot sign files and will not appear in the signing key list.