decrypting emails with enigmail in thunderbird does not work anymore. It is because I don't get the chance to punch in my passphrase, a form asking me to do so used to pop up, now it's not and I'm getting this message:

Error - no matching private/secret key found to decrypt message; click on 'Details' button for more information

The private key is available though, since

gpg -d Desktop/mail.eml     

makes the form appear. After filling in my passphrase I can read the decrypted mail within the terminal.

Another hint for a problem with the passphrases appeared when I created to new keys today. I could not create a revocation certificate because there was no passphrase set. Which, again, is not true.

I first noticed the problem on Monday, August 31st.

I checked the internet for a bit and then did the following:

  1. Make sure an instance of gpg-agent is running:

    gpg-agent -v


    gpg-agent: gpg-agent running and available

    Content of .gnupg/gpg-agent.conf:

    default-cache-ttl 0
    max-cache-ttl 0

  2. Go to dconf Editor desktop->gnome->crypto->cache and set gpg-cache-ttl to 0

  3. Thunderbird Enigmail->Clear Saved Passphrases gives an Enigmail Alert saying:

    You are using gpg-agent for passphrase handling. Clearing the passphrase is therefore not possible from within Enigmail.

    Thunderbird Enigmail->Preferences->Basic Remember passphrase for 0 minutes of idle time

  4. Make gpg-agent forget my passphrase:

    pkill -SIGHUP gpg-agent
  5. Seahorse->GnuPG keys delete all keys and reimport them

None of that list made any difference to the problem. I wonder, how do I get Enigmail to ask for my passphrase again?

Thanks in advance!


  1. Removing /etc/xdg/autostart/gnome-keyring-gpg.desktop didn't do anything.
  2. Removing seahorse didn't do anything.
  3. Using decrypt-file:

    Couldn't decrypt file: mail.eml.pgp
    Bad passphrase
  • Install pinentry-gtk2 on Ubuntu with Unity
    – Natim
    Dec 22, 2016 at 8:23
  • I have this problem, too, but oddly I can sign my own emails, but it gives your same message when I try decrypting messages signed with my pubkey.
    – Geremia
    Jan 21, 2018 at 0:05

8 Answers 8


Try this: https://www.enigmail.net/support/gnupg2_issues.php In my case, I need install a grafical version of pinentry (pinentry-qt4 package).

"Resolving issues with GnuPG 2.x and gpg-agent

Note GnuPG 2.x requires an "agent" to handle passphrases. By default this is done by gpg-agent, but there are other tools implementing a subset of its functionality. These instructions are for gpg-agent only. If you use an agent like gnome-keyring, seahorse-agent or the KDE Wallet Manager, then these instructions don't apply. Most common Problem


The most common issue is that gpg-agent (a part of GnuPG) cannot launch pinentry (the tool used to query your passphrase). Enigmail would display messages like:

when reading messages:
Error - no matching private/secret key found to decrypt message; click on 'Details' button for more information

when sending messages:
- Send operation aborted. Error - encryption command failed
- Send operation aborted. Key 0x....... not found or not valid. The (sub-)key might have expired

How to Analyze

Try sending a signed and unencrypted message to yourself.
Check the output in the Enimgail log: go to menu Enigmail > Debugging Options > View Log.
Search for the following text: parseErrorOutput: status message. You will probably find this message several times. Check what follows below.
If the message says something like "no pinentry", "problem with the agent", "Invalid IPC response" or "problem with gpg-agent", then there is something wrong with your gpg-agent and/or pinentry setup.

How to Fix it

Execute the following script from a terminal to find out if a graphical version of pinentry is used:

pinentry <<EOT
SETDESC Hello World

You should get a graphical window with a confirmation message "Hello World". If a "window" is opened within your terminal window then pinentry is text-based, which does not work with Enigmail. To fix this, ensure that a graphical version of pinentry is installed. On Linux/Unix systems, these would typically be pinentry-qt/pinentry-qt4 or pinentry-gtk/pinentry-gtk2, and on Mac OS X pinentry-mac. Rename the existing pinentry file to "pinentry-text" or similar, and create a symlink from pinentry-qt, pinentry-qt4, pinentry-gtk, pinentry-gtk2 or pinentry-mac to pinentry. Then restart your PC.

If the above does not help, check the contents of $HOME/.gnupg/gpg-agent.conf. Make sure that there is a configuration entry pinentry-program containing the full path to a graphical version of pinentry as above. E.g.:

pinentry-program /usr/local/bin/pinentry-gtk

Then save the file and restart your PC.

If you still can't access your key, then execute the following script from a terminal:

gpg-connect-agent <<EOT
GETINFO version

The output should be something like the text below, where 2.0.26 represents the agent version number. The version number should match your gpg version number:

D 2.0.26

If you get an error message like "ERR 280 not implemented" then you don't use gpg-agent, but one of the alternatives like gnome-keyring. We recommend you switch to gpg-agent by disabling your current agent. See e.g. askubuntu for how to disable gnome-keyring or how to disable KDE wallet.

If you get a useful result from above, then execute the following script from a terminal:

gpg-connect-agent <<EOT

Pinentry should now open as a graphical window (just like above), with the difference to the step above that this instance of pinentry was launched from gpg-agent. If this is successful, then GnuPG 2 should work correctly in Enigmail.

If gpg-agent still cannot launch pinentry from Enigmail, then you need to start debugging gpg-agent. Execute the following commands from a terminal:

killall gpg-agent
gpg-agent --debug-level expert --use-standard-socket --daemon /bin/sh

This will start gpg-agent from the command line, open a new shell and print the debug output to that shell. If the command succeeded, you will see somehting like:
gpg-agent[76979]: gpg-agent 2.0.26 started
Leave the terminal window untouched, start Thunderbird and try to use Enigmail. As you'll try to access gpg-agent, you will see the output in your terminal window. If gpg-agent cannot start pinentry successfully, you will see something like this:

gpg-agent[76993]: starting a new PIN Entry
gpg-agent[76993]: chan_19 <- ERR 67109133 can't exec `/usr/bin/pinentry': No such file or directory
gpg-agent[76993]: chan_19 -> BYE
gpg-agent[76993]: can't connect to the PIN entry module: IPC connect call failed
gpg-agent[76993]: command get_passphrase failed: No pinentry

Press Ctrl+D in the terminal to end the debugging session. The bold line should tell you the reason for the error (in the example above, pinentry cannot be found). Try to fix the error and repeat the test."
  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Oct 18, 2015 at 14:29
  • The last bit says "If gpg-agent still cannot launch pinentry from Enigmail, then..." - but IF pinentry is launched correctly, but the decryption does still not work, the guide does not help here...
    – nerdoc
    Jul 11, 2017 at 19:22

I had the same problem, but found that killing gpg-agent was a workround.

(From the source code I found that you can enable enigmail logging by editing the "defaults/preferences/enigmail.js" file somewhere under ~/.thunderbird, setting the "extensions.enigmail.logDirectory" property to "/tmp". The log file "/tmp/enigdbug.txt" then showed the full gpg command that enigmail was running, ending with "--use-agent". I ran that gpg command from the command-line, feeding it an encrypted email message. It complained with the error message "gpg: problem with the agent: No PINentry". Googling for that error message turned up the suggestion to kill the gpg-agent. Meanwhile, the NSA rubs its hands in glee that the user experience of PKI encryption is so rubbish.)

  • I have the same problem as the OP. Perversely, running the exact command found in enigdbug.txt yields perfect results. :\
    – Joel Cross
    Nov 17, 2015 at 21:37
  • Did not help here. Although, gpg -d message.eml hat the same problem: gpg: public key decryption failed: No passphrase given - without asking me for a passphrase
    – nerdoc
    Jul 13, 2017 at 19:10

I had a similar problem. Thunderbird was asking again and again to put in my key's password and Gnome keyring wouldn't remember it, although I asked it to. The problem was, that gpg-agent wasn't running in my session. The problem vanished when I manually started it in the current session with:

gpg-agent --debug-level expert --use-standard-socket --daemon /bin/sh

To solve the problem permanently you have to assure, that the agent is running in your session: 1. Check you have the following file /etc/X11/Xsession.d/90gpg-agent. Mine looks like this:

  : ${GNUPGHOME=$HOME/.gnupg}


  if grep -qs '^[[:space:]]*use-agent' "$GNUPGHOME/gpg.conf" "$GNUPGHOME/options" &&
     test -x $GPGAGENT &&
     { test -z "$GPG_AGENT_INFO" || ! $GPGAGENT 2>/dev/null; }; then

     if [ -r "$PID_FILE" ]; then
         . "$PID_FILE"

     # Invoking gpg-agent with no arguments exits successfully if the agent
     # is already running as pointed by $GPG_AGENT_INFO
     if ! $GPGAGENT 2>/dev/null; then
         STARTUP="$GPGAGENT --daemon --sh --write-env-file=$PID_FILE $STARTUP"
  1. Check you have the file ~/.gnupg/gpg.conf, with at least the following line:


If not, you can add it with the following command:

echo "use-agent" >>  ~/.gnupg/gpg.conf 
  • use-agent is not needed any more in OpenGPG 2.1 - the agent is used in any case.
    – nerdoc
    Jul 11, 2017 at 19:19

Got the same error error about pinentry. At the end, I figured out that the gpg-agent was using the wrong pinentry. Solved it by setting the right pinentry by editing ~/.gnupg/gpg-agent.conf and adding the following line

pinentry-program /usr/bin/pinentry-gtk-2

Default for the system I'm working at was pinentry-x11(it's an company wide installation which allows a variety of window managers), which did not work for gnome3. - So one has to make sure that the gpg-agent is using the correct pinentry for the actual window manager in use.


In my case it was just that I didn't have any pinentry tools except for pinentry-curses (command line with pointer support). So in Fedora install any of these passphrase/PIN entry dialogs:

  • pinentry-qt.x86_64 based on Qt4;
  • pinentry-gtk.x86_64 based on GTK+;
  • pinentry-emacs.x86_64 for emacs;
  • pinentry-gnome3.x86_64 for GNOME 3.

I used the GNOME 3 pinentry package.


In thunderbird, select the message, click on the hamburger, expand the Enigmail menu and select decrypt/verify. You'll get a password prompt after which the message will be decrypted.

  • Doesn't make any difference...
    – nerdoc
    Jul 11, 2017 at 19:21
  • Can you clarify? Do you not get the password prompt, or is the message not decrypted?
    – Mr. Wrong
    Jul 12, 2017 at 20:39

I had a similar problem! Following the gpg-agent debug done with:

gpg-agent --debug-level expert --use-standard-socket --daemon /bin/sh

I found out that something was broken between enigmail and gpg and it never asked for a passphrase. But in the case the passphrase was pre-loaded all worked perfectly.

In my case the problem what that, in the past, I forced the follow option in the ~/.gnupg/gpg.conf

pinentry-mode loopback

This broke the process. You can check the command that enigmail is running enabling the expert mode in Enigmail and then in "Debugging Options --> View Console"

Commented and everything worked.


I had the same problem with Ubuntu Budgie 18.04. For some reason pinentry-gnome3 didn't display a dialog.

I could solve the issue by installing pinentry-fltk and also selecting it in update-alternatives:

sudo apt-get install pinentry-fltk
sudo update-alternatives --config pinentry

In the shown dialog select usr/bin/pinentry-fltk

There are 2 choices for the alternative pinentry (providing /usr/bin/pinentry).

  Selection    Path                      Priority   Status
  0            /usr/bin/pinentry-gnome3   90        auto mode
* 1            /usr/bin/pinentry-fltk     70        manual mode
  2            /usr/bin/pinentry-gnome3   90        manual mode

Press <enter> to keep the current choice[*], or type selection number: 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .