Install

I'm going to assume that you already have a GnuPG keypair, if not there are lots of guides. You'll also need to have a GPG agent, I use Keychain which is the easiest way if you have to look after SSH and GPG keys.

Install gnupg.vim in the usual way that you handle Vim plugins. I'm using Neobundle, so for me it is:

NeoBundleLoad 'jamessan/vim-gnupg'

In .vimrc add the following:

" Armor files
let g:GPGPreferArmor=1
" Set the default option
let g:GPGDefaultRecipients=["la@la.com"]

The first option sets GPG to armor files for transmission over a text only medium, in other words you can send any files it creates over email fine. The second option is the default public key that you want any file to be encrypted to: this will be your own public key. Note that you can use GPGDefaultRecipients to specify a set of keys separated by commas.

This is not required, but I have some additional configuration in my .vimrc:

augroup GPG
    autocmd!
    autocmd FileType gpg setlocal updatetime=12000
    autocmd CursorHold *.\(gpg\|asc\|pgp\) quit
augroup END

These options set that if nothing happens in an encrypted file for 12 seconds Vim will quit. This stops me accidentally leaving a secure file unencrypted when I leave my desk [3]. The first line clears the autocmd group and for the GPG file type we set updatetime to be 12 seconds. The second option says that when the CursorHold time elapses (12 seconds) Vim will quit. Note that it won't quit if you've made a change and haven't saved the buffer to file or if you're still in insert mode.

The plugin can get confused if it cannot interact with gpg-agent correctly. In .bashrc I have:

GPG_TTY=`tty`
export GPG_TTY

Finally, at the bottom of any file that I want to edit I add the following modeline:

" vim: ft=gpg fdm=marker foldcolumn=2

This specifies that the filetype is gpg, we need this to make the quit after 12 seconds thing work.

Common Usage

Any file ending in .gpg, pgp or asc is automatically recognised.

• To create a new file do:

  vim somefile.asc
  

The first time it sees a file with the right extension it pops up a buffer window showing you recipients to encrypt the file for. When you save the file it automatically encrypts it using the public keys that were specified.

• Edit an existing file

When the encrypted file is edited gpg.vim detects that the file is encrypted and decrypts it using the public key it has access to. At the end of the editing session it will re-encrypt it.

• Warning about unencrypted files

If a file with one of the extensions is not encrypted then it will give you a warning when you open it in Vim.

• Manual tests

To test it we can also automatically encrypt a file using a public key, something like this:

# Put some text in a file
vim test.txt
# Encrypt the file
gpg --recipient <some@email> --armor --output test.asc --encrypt test.txt
# Test that it decrypts it
vim test.asc

Commands

There are also a few commands, though I rarely use them:

Further reading

• Password Management with Vim and GnuPG
• Secure, Distributed Password Resources with GPG, Git and Vim

Final Thoughts

I don't feel I've really done this tool the justice it deserves. It saves me a lot of time and helps me to keep files secure that I probably wouldn't if I had to remember all the GnuPG switches. Transparent, automatic security, it's the way to go!