Secure File Transfers with GPG and rsync

The server waits. Your terminal blinks. You need fast, secure file transfers that can survive bad networks, flaky connections, and untrusted intermediaries. That’s where combining GPG with rsync becomes a lethal tool in your workflow.

What is GPG + rsync?
GPG (GNU Privacy Guard) encrypts and signs data. rsync synchronizes files across systems with minimal transfer overhead. Alone, each is powerful. Together, they let you push and pull data across remote hosts while keeping every byte encrypted at rest and in transit. With GPG rsync, even if someone captures your traffic, it’s useless to them.

Why use GPG with rsync?

• End-to-end encryption, without relying on transport security only.
• File integrity checks, using GPG signatures before accepting changes.
• Storage without plain text data, even on intermediate systems or backup servers.
• Minimal bandwidth use because rsync sends only diffs, not full files.

Setting it up

1. Generate a GPG key if you don’t have one:
   

gpg --full-generate-key

1. Export your public key to share with the other system:
   

gpg --armor --export your@email.com > pubkey.asc

1. Encrypt files before rsync:
   

gpg --encrypt --recipient "Recipient Name"file.txt

1. Sync encrypted files:
   

rsync -avz encrypted_file.txt user@remote:/path/

1. On the receiving side, decrypt with the private key:
   

gpg --decrypt encrypted_file.txt > file.txt

You can script the encryption and transfer into a single pipeline, wrapping rsync in a pre-transfer hook that encrypts files, and a post-transfer hook that decrypts them. This keeps every transfer secure and automated without extra manual steps.

Best practices for GPG rsync

• Use strong keys (4096-bit RSA or modern ECC).
• Disable password caching in GPG for private key security.
• Keep offline backups of keys.
• Test integrity with gpg --verify after decryption.

Whether you’re moving backups, code, or critical documents, running rsync with GPG gives you control over both performance and security. You decide where the keys live, and nothing leaks outside your trust boundary.

Lock down your workflows with tools that respect your rules. Head to hoop.dev, wire up your secure transfers, and see it live in minutes.