Page Contents:
Encryption and Signing Webmail (works with any webmail account!)
Encryption and Signing using your existing webmail email addresses in a Mail Client (software based)

Webmail: It's a commonly asked question - how do I use encryption and digital email signing with my webmail account? Fortunately, it's possible and instructions are right here!

NEW! Firefox Extension lets you encrypt and sign your webmail!
A new Firefox extension called FireGPG offers great integration of OpenPGP encryption and digital signature features for use in any Webmail service. In fact, FireGPG even works in text-boxes online, so it's possible for you to sign forum posts and blog entries as well if you so wish!  It's easy to set up, but requires a small amount of understanding how to use GPG.

Firstly, you will need a GPG key pair and some means of storing other user's key pairs.  If you use Thunderbird, this can be achieved using the Enigmail key manager - see this page for more details. If not, the simplest way to do so is to download and install WinPT (download GPG4Win if you do not already have GnuPG installed).  Next, you will need to generate a key pair - this is achieved from the WinPT Keymanager:

Once you have generated your own key, you can import the public keys of your friends and contacts - either aske them to send these to you or get them from a keyserver. Add them to your WinPT Key Manager list.

The next stage is to install FireGPG in Firefox. Once you have done so, you will need to restart Firefox. Once this is done, select TOOLS > FIREGPG > OPTIONS

You now need to "tell" FireGPG where you installed GnuPG (if you installed it with WinPT, it will be in the WinPT directory).  Under the OPTIONS menu, select the path to "gpg.exe" (if different from the default path), and select the private key from the list that you want to use by default (this can be changed at any time).  You also have the option to add specific Gmail support - this simply adds a few buttons next to "Send" in the Gmail interface (Crypt and Send / Sign and Send etc).  You do not need to enable this for FireGPG to work in the Gmail interface - it just makes it a one-click operation as opposed to a two-click operation.

Once these steps are completed, you're good to go! Log into your webmail page and start to type your email - however, you should note that using plain text instead of html when composing will avoid any potential problems.  To do this in Gmail, simply click the "Plain Text" button next to the formatting tools:

Now, you simply type your email as normal - just don't click "send" quite yet. If you are using Gmail and you have the options enabled, hit "Crypt and Send" or "Sign and Send" etc as desired, enter your passphrase when asked and then select the public key of the person you are sending the email to from the pop-up menu. Then hit "send" as normal and your email will be secured and sent. If you are not using Gmail or don't have the Gmail buttons enabled, select the text in the body of your email only, right-click, select FIREGPG > ENCRYPT (or other as desired) then enter your password. 

 =>

Once the text is shown in the encrypted form (see diagram on right), you simply select "Send" as normal from within your email program and the job is done!  You have communicated securely and easily.  Despite being a little tricky for new users to set up initially, FireGPG is an excellent extension for Forefox that really makes the use of OpenPGP technologies with Webmail a viable option.

If you have problems with FireGPG iself, see the developers website at http://firegpg.tuxfamily.org/ but feel free to get in touch if you need some advice.

Encryption and Signing using your existing webmail email addresses in a Mail Client
It is also possible for you to use a mail client to collect, send, sign, encrypt and decrypt your email along with your existing webmail services such as Gmail, Hotmail, AOL, Mail.com and so on.  Instructions are provided below for Mobility Email (a free, open source mail client that requires no installation and will work on any PC from a USB flash drive - click here for more details) and for Mozilla Thunderbird:

Mobility Email:
Mobility Email is an email client that I was involved in developing. It is a single download that comes pre-configured with OpenPGP Encryption built-in, and it's designed to run off a USB Flash Drive, iPod or other portable media - since it's not an install file, it doesn't matter what drive letter it's under. The instructions below show you how to set up an installation of Thunderbird with support for Webmail accounts (an installation version will perform quicker for every day use on a fixed computer), but Mobility Email has this ability built-in. Try it yourself - it's free and open-source!

If you are having problems getting your webmail to work, there may be a compatibility update required - this is easy to do. Simply select TOOLS > EXTENSIONS > CHECK FOR UPDATES and install any webmail updates that are offered.

Using email encryption and signing with Hotmail, Yahoo! Mail and others:
You will need to use a mail client program - Mozilla Thunderbird is the best option. Install and configure Thunderbird using these instructions.
Next, go to http://webmail.mozdev.org
Click on the "Installation" link, and download webmail*.xpi by right-clicking and saving the link.
Next, download the appropriate additional extension, eg. hotmail*.xpi again by right-click > save.
Open Thunderbird, select TOOLS > EXTENSIONS > INSTALL and install the two xpi files you downloaded.
Restart Thunderbird, click TOOLS > ACCOUNT SETTINGS > NEW ACCOUNT
Select the option for "WebMail" and configure your email address, username and password.

As with Mobility Email, if you are having problems getting your webmail to work, there may be a compatibility update required -  simply select TOOLS > EXTENSIONS > CHECK FOR UPDATES and install any webmail updates that are offered.

Now, you will be ready to send and receive emails. Simply generate a key pair and you can now communicate securely!

Using email encryption and signing with Gmail:
Gmail is an excellent mail service - it comes with a free POP and SMTP service, so you do not need any Thunderbird extensions to use OpenPGP encryption with your Gmail account!  It's easy.

Simply download and install Mozilla Thunderbird, and add a new account using Gmail's instructions.

If you chose the above option, you will not be able to retrieve emails by POP more than once - therefore, if you use another POP client with Gmail elsewhere, you may be best installing the webmail extension and using this method with Gmail.  Instructions are the same as with Hotmail and Yahoo Mail above.

You can then configure Thunderbird to use OpenPGP encryption, generate a key pair and you're ready to communicate securely!  Easy as that!