Where apps hide your files

The ~/.gnupg folder explained

Updated 2026-10-28 · 6 min read

GnuPG stores your keyring, private keys and settings in one hidden folder, ~/.gnupg. Here is what lives in it, which parts are secret, and how to back it up without exposing anything.

The location

~/.gnupg

That is the default GnuPG home directory, per the GnuPG manual. It applies unless the GNUPGHOME environment variable or the --homedir option points somewhere else. If you installed GPG Suite, Homebrew's gnupg, or MacPorts, this is normally still the folder, because they all run GnuPG underneath. To get the real answer for your setup, run:

gpgconf --list-dirs homedir

That prints the directory in use and nothing secret. The folder does not exist until GnuPG first runs, and it was absent on the Mac used for this guide, where GPG is not installed. The details below come from GnuPG's documentation.

Opening the folder

It is hidden. In Finder choose Go > Go to Folder (⇧⌘G) and type ~/.gnupg, or from Terminal:

open ~/.gnupg

To see names, sizes and permissions without opening anything:

ls -la ~/.gnupg

Good permissions are drwx------ on the folder, meaning only you can enter it. If GnuPG warns about unsafe permissions, the fix is chmod 700 ~/.gnupg, which changes only the permission bits.

What is inside

Name	What it is
pubring.kbx	Your public keyring (and the public keys you imported), in the newer keybox format.
private-keys-v1.d/	Folder where gpg-agent stores your private keys, one file per key.
trustdb.gpg	The trust database. The manual says there is no need to back it up; back up your ownertrust values with gpg --export-ownertrust instead.
openpgp-revocs.d/	Revocation certificates GnuPG pre-generates when you create a key.
gpg.conf	Options for the gpg command. You create it.
gpg-agent.conf	Options for the agent, such as the pinentry program. You create it.
dirmngr.conf	Keyserver and network settings. Optional.
pubring.gpg, secring.gpg	Legacy formats: pubring.gpg is the old public keyring, and secring.gpg the secret keyring GnuPG used before version 2.1. Current GnuPG does not use secring.gpg.
random_seed	Random-number state. Ignore it.

Settings files such as gpg.conf are not created for you. If the folder has only the keyring files, you are on defaults.

What is secret

The files in private-keys-v1.d are your private keys. Anyone holding one, plus your passphrase, can sign and decrypt as you. Never email, paste or upload them, and never commit this folder to Git. The public keyring and your revocation certificates are not secret in the same way, but treat revocation certificates carefully too, because anyone who has one can mark your key as revoked.

Getting a key out the supported way

Do not copy the folder around as a routine. Export what you need with GnuPG:

• Public key, safe to share: gpg --armor --export <key ID or email>
• Private key, for a backup only: gpg --armor --export-secret-keys <key ID>, written to a file on an encrypted drive, never a shared folder.

The second command prints a secret to the screen unless you redirect it to a file, so add > backup.asc and store that file offline. GPG Suite's GPG Keychain app also has an export option in its menus, but this guide did not verify the menu wording because the app is not installed on the Mac used for it.

Moving to a new Mac

Use the export commands above and import on the new Mac with gpg --import <file>, then restore trust with gpg --import-ownertrust from a file made by gpg --export-ownertrust, or set it again by hand. Copying the whole ~/.gnupg folder also works if you preserve permissions, and then it is wise to run gpg --list-keys to check. Quit any running agent first with gpgconf --kill gpg-agent.

GPG Suite and Homebrew differences

GPG Suite installs GPG Keychain, GPG Mail, GPG Services and a bundled GnuPG engine called MacGPG, per its website. Its engine lives in /usr/local/MacGPG2, with a gpg link in /usr/local/bin, according to GPG Suite's support forum. On an Intel Mac that link competes with Intel Homebrew's gpg in the same folder, and which -a gpg can show two programs. Both read the same ~/.gnupg unless GNUPGHOME differs, so keys made in one show up in the other. Homebrew's gnupg formula puts the program under /opt/homebrew/bin (Apple silicon) or /usr/local/bin (Intel).

Checking the setup without exposing keys

Some read-only commands show your setup without printing secrets. gpgconf --list-dirs prints every directory GnuPG uses, including the home folder and the agent's socket folder. gpg --version prints the version and the home directory. ls -la ~/.gnupg shows file names, sizes and permissions. Avoid cat on anything in private-keys-v1.d, and be careful with screen shares. Socket files for the agent, with names starting S. such as S.gpg-agent, are normal; gpgconf --list-dirs socketdir prints where they are. Do not delete them while the agent runs.

Why searches miss it

~/.gnupg is a hidden dot-folder, and Spotlight and Finder searches leave results from it out.

Finding the files next time

Typing pubring or trustdb into Everywhere finds the keyring files wherever they sit, including copies inside old backups, and a search for gpg.conf lists every config of that name. It matches names only, so it cannot tell you what a keyring holds. ⌘↵ reveals a result in Finder.

Common questions

Where does GPG store keys on a Mac?

In ~/.gnupg by default: public keys in pubring.kbx, private keys in private-keys-v1.d/. gpgconf --list-dirs homedir prints the folder in use.

Where is gpg.conf on macOS?

In the GnuPG home folder, normally ~/.gnupg/gpg.conf. It is not created for you, so create it if you want to set options.

Does GPG Suite use a different folder?

GPG Suite runs GnuPG underneath, so it normally uses the same ~/.gnupg folder. If you set GNUPGHOME, that folder is used instead.

Is it safe to copy my ~/.gnupg folder?

It contains your private keys, so only copy it to an encrypted drive you control. Exporting a key with gpg --export-secret-keys to a file is the more deliberate route.