Is it possible to edit encrypted files from inside Emacs? I’d like to keep a file encrypted on disk, and even better, never have the decrypted parts swapped out to disk. Has this already been done? --ShaeErisson

There are a few solutions for this listed below; note that among them, EasyPG is the only one which is bundled with Emacs and is a supported part of current Emacs releases.

EasyPG Assistant

EasyPG is an all-in-one GnuPG interface for Emacs. It has two aspects: convenient tools which allow to use GnuPG from Emacs (EasyPG Assistant), and a fully functional interface library to GnuPG (EasyPG Library).

EasyPG disables auto-save by default, and does not write unencrypted contents to disk.

This library worked out of the box for me. In contrast to most other approaches discussed here, easy-pg does not change the major mode.

EasyPG Assistant is bundled with Emacs since version 23.1; it handles gpg encrypted files out-of-the-box so (my) mc-gpg-file-mode is now obsolete.


You can get the code for this at Lisp:mc-auto-encrypt.el. This method takes advantage of the FileLocalVariables to evaluate a form, mc-auto-encrypt, and setup a before-save-hook and after-save-hook that handles the decryption and encryption. To start using it on a plain text file you need to put (require 'mc-auto-encrypt) in your DotEmacs and then place this at the end of your unencrypt text file:

 Local Variables:

Using mc-auto-encrypt, the file is always displayed unencrypted. The buffer’s modification state reflects the modification of the unencrypted text. When you save the file you are prompted (via MailCrypt) for the recipient. That should be at least you so that you can decrypt it later. You can also add additional recipients at this time if you want others to have access to the file. MailCrypt also prompts whether to sign the message or not. I’m not sure how much this matters if you’re only encrypting it to yourself.

Note that I’ve set mc-password-timeout to a fairly large value so I’m not prompted for my (complicated to type) GnuPG pass phrase every time I save the file. I’m not totally paranoid. I just want some reasonable way to protect my hosts, usernames, and passwords if my laptop were stolen.

This method of auto encryption makes no more efforts than MailCrypt to protect the unencrypted text from memory. In other words, I believe someone could extract the clear text of the file either from memory or from swap space. I don’t know if emacs has a way to take advantage of the ‘mlock’ POSIX function to disable paging for memory locations.

If you need to see the encrypted, ASCII guarded text in emacs, you should adjust the value of enable-local-eval.

This is known to work with mailcrypt version 3.5.8, GNU Emacs 21.2.2, and GnuPG 1.2.1


Based on MailCrypt there is Lisp:mc-gpg-file-mode.el which allows automatic decryption / encryption of files ending with ‘.gpg’ at file open / save. This can e.g. be used to comfortably handle a gpg encrypted (ASCII) file with passwords or such ‘secrets’.

rewrite using pgg

Note that this requires emacs22+. This just a re-write of Lisp:mc-gpg-file-mode.el to use the built-in functions that emacs22+ now has.

Also, because of the way pgg operates, this does write out a temporary file to disk with the unencrypted contents. The file is quickly erased, but user beware.

Add this to your .emacs file and any filename ending with .gpg will be treated as encrypted:

(defvar pgg-gpg-user-id "YOUR-ID-HERE")
(autoload 'pgg-make-temp-file "pgg" "PGG")
(autoload 'pgg-gpg-decrypt-region "pgg-gpg" "PGG GnuPG")
(define-generic-mode 'gpg-file-mode
  (list ?#) 
  nil nil
  '(".gpg\\'" ".gpg-encrypted\\'")
  (list (lambda ()
	    (add-hook 'before-save-hook
                      (lambda () 
                        (let ((pgg-output-buffer (current-buffer)))
                          (pgg-gpg-encrypt-region (point-min) (point-max)
                                                  (list pgg-gpg-user-id))))
                      nil t)
	    (add-hook 'after-save-hook 
		      (lambda ()
                        (let ((pgg-output-buffer (current-buffer)))
                          (pgg-gpg-decrypt-region (point-min) (point-max)))
			(set-buffer-modified-p nil)
			(auto-save-mode nil))
		      nil t)
            (let ((pgg-output-buffer (current-buffer)))
              (pgg-gpg-decrypt-region (point-min) (point-max)))
	    (auto-save-mode nil)
	    (set-buffer-modified-p nil)))
  "Mode for gpg encrypted files")

crypt++ and gnupg

CryptPlusPlus can also be used with GPG to automatically encrypt and decrypt buffers.

Another approach is to encrypt files transparently with emacs-wiki. See CryptPlusPlus.

auto-crypt (patch)

[Actually, crypt++ uses mailcrypt too.]
mc-auto-encrypt isn’t clean. Note particularly that it is likely to trash non-ASCII text, as is anything using Mailcrypt or crypt++. The right thing is to adapt auto-compression-mode to handle encryption with gpg, per Emacs TODO. Bundled diffs for what I use along that line are at auto-crypt.tgz. They involve a patched version of the PGG support code from a recent Gnus rather than using Mailcrypt (which can’t be included with Emacs). Actually, the right thing might be to use ‘format-alist’ entries for the job, but that interacts badly with what PGG does and happens at the wrong time for coding conversion.


See “Emacs Support” section on

This actually works over SSH.

Download source and
$ ./configure && make install

Current instructions on home page of how to enable in .emacs are wrong. Add this instead:

(setq load-path (cons "path" load-path)) ; where path is the path where ps-ccrypt.el is located
(require 'ps-ccrypt "ps-ccrypt.el")

Now, simply open a file you want to encrypt and save (C-x C-w) with “cpt” extension.

See also

CategoryFiles CategoryCryptography