Sequoia PGP
sequoia-pgp.org · Company blog · on HN since 2018
Project site for Sequoia PGP, a Rust implementation of OpenPGP with a command-line tool called sq.
What HN saysCommenters suggest it as a cleaner alternative to GnuPG for those set on PGP. One notes its sq CLI reached v1.0 in December 2024.
44HN people shared it
28linked it in comments
45stories submitted
1.3Kstory points
10 months agolast shared
2018people per year2026
Most-shared posts
- 1Sequoia-PGP – A new OpenPGP implementation in Rust25 people · 314 points · first shared 2018 · 95 comments on HN
- 2Sq, Sequoia PGP's CLI, Released4 people · 115 points · first shared 2021 · 15 comments on HN
- 3Hey Signal Great Encryption Needs Great Authentication3 people · 31 points · first shared 2021 · 1 comments on HN
- 4The Future of Sequoia PGP3 people · 6 points · first shared 2021 · discussion on HN
- 5Certificate Flooding, SKS and GnuPG Issues, and the Sequoia Project3 people · 4 points · first shared 2019 · discussion on HN
- 6Sequoia GnuPG Chameleon3 people · 3 points · first shared 2022 · discussion on HN
- 7Towards Sequoia OpenPGP v1.02 people · 83 points · first shared 2020 · 59 comments on HN
- 8Hello, OpenPGP CA2 people · 77 points · first shared 2021 · 11 comments on HN
- 9Yes, We Want Cryptographic Protection for Email2 people · 54 points · first shared 2021 · 4 comments on HN
- 10Super Powering End-to-End Email Encryption in Mozilla Thunderbird2 people · 39 points · first shared 2021 · 3 comments on HN
- 11Sq Comparison with GPG2 people · 8 points · first shared 2022 · discussion on HN
- 12Ver 1.2 of Octopus, Sequoia's OpenPGP Back End for Thunderbird, Released2 people · 2 points · first shared 2021 · discussion on HN
- 13RPM Sequoia: A Sequoia-Based Back End for the RPM Package Manager2 people · 2 points · first shared 2023 · discussion on HN
- 14Hagrid: A New Verifying Key Server Built on Sequoia (2019)2 people · 1 points · first shared 2019 · discussion on HN
- 15Sequoia PGP 1.0 Released: The Seedling Is a Sapling1 people · 156 points · first shared 2020 · 57 comments on HN
What HN people wrote when they linked it
darkr · 2021-06-08
The other points in this thread recommending modern, context-specific cryptography tools are very valid, however if you're set on PGP; Sequoia[1] is a new(ish) OpenPGP library written from the ground up in Rust.
1: https://sequoia-pgp.org/
zimmerfrei · 2026-01-04
As mentioned a few days ago, this post mainly covers a gpg problem not a PGP problem.
I recommend people to spend some time and try out sequoia (sq) [0][1], which is a sane, clean room re-implementation of OpenPGP in Rust. For crypto, it uses the backend you prefer (including openssl, no more ligcrypt!) and it isn't just a CLI application but also as a library you can invoke from many other languages.
It does signing and/or encryption, for modern crypto including AEAD, Argon2, PQC.
Sure, it still implements OpenPGP/RFC 9580 (which is not the ideal format most people would define from scratch today) but it throws away the dirty water (SHA1, old cruft) while keeping the baby (interoperability, the fine bits).
[0] https://sequoia-pgp.org/
[1] https://archive.fosdem.org/2025/events/attachments/fosdem-2025-6297-a-…
upofadown · 2025-11-29
This is mostly about the usability issues that make such attacks work so well on Signal:
https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-sign…
This adds some detail about how Signal can do MITM attacks:
https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-great-encryp…
Some of the details might of changed since publication. My current understanding is that Signal doesn't even bring up the idea of identity verification if a user has not previously done it. So if anything, things have gotten worse.
kincl · 2025-11-14
Having done just a small to moderate amount of automation in CI/CD pipelines around GPG tools I know this pain. Back then I was waiting for https://sequoia-pgp.org/ which recently (Dec 2024) released its v1.0 of the sq CLI which seemed to have a lot of promise of fixing the strange and inconsistent ergonomics of using the gpg tools.
s20n · 2025-11-01
> This extends at first to the Rust compiler and standard library, and the Sequoia ecosystem.
By Sequoia, are they talking about replacing GnuPG with https://sequoia-pgp.org/ for signature verification?
I really hope they don't replace the audited and battle-tested GnuPG parts with some new-fangled project like that just because it is written in "memory-safe" rust.
thayne · 2025-04-17
You may be interested in https://sequoia-pgp.org/
It isn't exactly a wrapper, but it has an easier to use interface (as well as a more gpg compatible interface).
cassepipe · 2024-10-07
Not to be confused with the gpg alternative from sequoia-pgp also called sq : https://sequoia-pgp.org/
awoimbee · 2023-02-10
How does it compare to https://sequoia-pgp.org/ ?
Sequoia has a library and a (sane) CLI.
gspr · 2022-09-14
Thankfully, an alternative PGP implementation is quickly gaining traction: https://sequoia-pgp.org/
lrvick · 2022-09-14
Gnupg is shit but PGP itself is just fine and we recently have more modern and well tested implementations of it now like https://sequoia-pgp.org/
southerntofu · 2022-02-25
Thanks for this article, it makes very good points. In particular, about the UX of GPG, i've found Sequoia to be a very good alternative: https://sequoia-pgp.org/
xvilka · 2022-01-04
On the one hand, I am glad it finally got the proper funding. On the other hand, I would prefer more effort going into more modern implementations [1] or protocols[2][3].
[1] https://sequoia-pgp.org/
[2] https://www.cryptologie.net/article/502/alternatives-to-pgp/
[3] https://blog.gtank.cc/modern-alternatives-to-pgp/
yepguy · 2021-12-16
Age is much simpler to use in nearly every way, whether that's interactively (keys are just files!), in scripting, or in implementation.
I'm still sticking to gpg for the foreseeable future, but between age and sequoia[1] I'm hopeful that things will soon be much easier to use.
[1]: https://sequoia-pgp.org/
e12e · 2021-08-24
I can understand the desire to shake off the burden of compatability with PGP - but maybe not if sticking to the same design, and just shifting encryption primitives somewhat?
If you want PGP - there's the sequoia project to consider as well:
https://sequoia-pgp.org/
The "stateless cli tool"[1] looks like it's mostly complete for sign/encrypt etc now?:
https://gitlab.com/sequoia-pgp/sequoia-sop
sqop generate-key [email protected] > julia.secret.pgp
sqop extract-cert < julia.secret.pgp > julia.public.pgp
echo "a message" | sqop encrypt julia.public.pgp > message.pgpo
sqop decrypt julia.secret.pgp < message.pgp
a message
[1] https://www.ietf.org/archive/id/draft-dkg-openpgp-stateless-cli-02.htm…
Apparently expired? Was sop abandoned?
tlamponi · 2021-06-08
It's not a tutorial in the classic sense, but as the CLI is rather simple, and as there are examples, I'd point you at the official docs (man page like):
https://docs.sequoia-pgp.org/sq/index.html
The sub commands feel like they are pretty much self-explanatory to me, e.g., encrypt, decrypt, verify are pretty clear in what they will do, and the options for those sub-commands seem not to cryptic either to me, but that's naturally a bit opinionated.
Besides that the initial release news article of the sq tool has some quick demo:
https://sequoia-pgp.org/blog/2021/01/26/202101-sq-release/
What would be your use cases for sq?
longtermd · 2020-04-27
Off topic af: what does the picture on their landing page symbolize? https://sequoia-pgp.org/
Leace · 2019-07-08
OpenPGP is not a product, it's a standard.
Maybe you're thinking of https://sequoia-pgp.org/ or https://neopg.io/ ?
Boulth · 2019-05-16
There is also sequoia, with an explicit goal of being easy to link to C. If you can bear the license.
Source: https://sequoia-pgp.org/
fanf2 · 2024-04-08
How does rpgp compare with Sequoia? https://sequoia-pgp.org/
Anthony-G · 2021-12-28
That would be Sequoia-PGP: https://sequoia-pgp.org/
lapinot · 2021-09-02
steveklabnik · 2019-07-13
signal11 · 2021-06-08
Good to see this project make progress -- well done to the development team. Whatever you think about pgp, it's not going away anytime soon, and a new implementation is an opportunity to brush away some cobwebs and even improve the ecosystem[1].
[1] https://sequoia-pgp.org/holistic-approach/
pas · 2020-06-02
GPG alternative:
https://docs.sequoia-pgp.org/sq/#subcommand-encrypt
https://sequoia-pgp.org/status/ is coming along nicely ( https://sequoia-pgp.org/blog/2020/04/26/202004-towards-sequoia-v1.0/ )
teythoon · 2019-07-17
We over at Sequoia-PGP, which gets a honorable mention by the OP, are not merely trying to create a new OpenPGP implementation, but to rethink the whole ecosystem.
For some of our thoughts on the recent certificate flooding problems, see https://sequoia-pgp.org/blog/2019/07/08/certificate-flooding-sks-gnupg…
dpc_pw · 2019-06-29
Is the new berifing SKS from Sequoia PGP (written in Rust!) affected as well? https://sequoia-pgp.org/blog/2019/06/14/20190614-hagrid/
hkt · 2025-03-16
People have thought about how to do forward secrecy with PGP:
https://sequoia-pgp.org/talks/2018-08-moving-forward/moving-forward.pd…
https://sequoia-pgp.gitlab.io/openpgp-dr/openpgp_dr/index.html
https://github.com/stealth/opmsg
https://github.com/autocrypt/autocrypt/issues/444
There's a lot going on in the space. It is more innovative than you're giving it credit for, especially around double ratchet. Not there yet, but there's a good reason why I don't mind: control. Multi client support (DeltaChat desktop, hallelujah) and the fact that email remains federation-first.
My identity definitely leaks to my server because I pay it's bill. Not only that, but most of my contacts run their own email or borrow it from me or someone else. Our data does not leave any EU countries apart from the UK. We have IM that doesn't involve any Americans.
Some might imagine we feel terribly smug about that right now :)
WiF3cap7ShUth4 · 2024-07-22
You can look at this https://sequoia-pgp.org/blog/2021/06/29/202106-yes-we-want-cryptograph…
I quote a section that corresponds to my situation
>Email is everyone’s primary trust anchor online
>If a user loses access to an online account, most services have an account recovery mechanism that will let the user back in. Usually, this works by sending an email to the user with a one-time password.
>If an attacker compromises a user’s email account, they can use the same mechanism to gain control of the user’s account on any service that uses the email account as a trust root. In practice, that’s most of the user’s online accounts. Unfortunately, two-factor authentication only offers limited protection. It is opt-in and usually uses a phone number, which is easily hijacked.
>If account recovery emails were encrypted, the trust anchor would instead be the encryption key. Since the encryption key is stored on the user’s computer, this would defeat this type of attack.