What is the SEC file format?
A .sec file contains private keys stored as ASCII-armored text or binary data. Such keys are used by the PGP encryption solution to secure the confidentiality and integrity of email data sent over open, unsecured channels.
Contents of a .sec file
The private key is saved either in ASCII text or binary format - the user can choose the preferred form by passing an appropriate flag to the key creation command. ASCII-armored .sec files begin with the recognizable header -----BEGIN PGP PRIVATE KEY BLOCK-----; binary files use an OpenPGP packet stream as defined in RFC 4880 (updated by RFC 9580 in 2024). In both cases, the secret key material is passphrase-protected via a string-to-key (S2K) derivation. The public counterpart to a .sec keyring commonly uses the .PKR extension, while armored exports may carry the .ASC extension.
How PGP works
*Pretty Good Privacy* uses a public key system for encrypting email messages. The public key, as the name suggests, is and should be publicly available by design. The PGP algorithm is designed in such a way that in order to decrypt a message encrypted with a public key, the private key of the same key pair is required. A key pair is generated automatically based, among other things, on the user's email address and username. It is essential for this system to work properly that the private key be protected against unauthorized access - the .sec file must therefore be stored in a secure environment.
Real-world analogy
In simple terms, PGP can be compared to how the traditional mailbox system works. The key to your mailbox is like your private key: anyone can drop a letter through the slot, but since only you possess the key, no one else can retrieve it. This is the simplified analogy to how the mechanism that PGP is based on works, and it also illustrates why the public key should be public while the private key and access to the .sec file must be strictly restricted.
Uses of PGP
*Pretty Good Privacy* is used for securing email messages from unauthorized access. Encryption also guarantees that the message was not tampered with in transit. PGP additionally offers the option to sign messages to authenticate the sender. Modern GnuPG (gpg command) no longer uses .sec files by default, storing all key material in an internal keybox (pubring.kbx); the .sec extension is mainly encountered with classic PGP desktop software such as Symantec Encryption Desktop and legacy key exports, often re-imported alongside .PGP files.
Security & safety
RISK: HIGHA .sec file contains PRIVATE key material - the most sensitive part of a PGP identity. Anyone who obtains the file AND its passphrase can decrypt your messages and impersonate you. Never email, upload, or share a .sec file; store it encrypted and back it up offline; use a strong passphrase. If a secret key is exposed, revoke it immediately and generate a new one. Be wary of "PGP key recovery" services that ask you to upload your secret key.
Format details
in a nutshell- Adobe Flash projector security/sandbox config (.sec) - Settings/SOL-related security file in some Flash deployments; legacy and unrelated to PGP.
- Steuererklaerung / certificate '.sec' files - Some tax and certificate tools store an encrypted user certificate as .sec; encrypted, not a keyring.
- Generic 'secure/encrypted' .sec output - Various apps name their encrypted/secured output '.sec'; format depends entirely on the originating app.
Programs that open SEC files
Windows2 apps
Gpg4win (Kleopatra)
Open-source Kleopatra > File > Import; enter the passphrase to add the secret key to your keyring.
Symantec Encryption Desktop (PGP)
Paid Import the secret keyring into the PGP keys manager (now Broadcom; legacy symantec.com/pgp link is dead). 
macOS2 apps
Symantec/PGP for Mac
Paid Import into PGP Desktop (now Broadcom); the old symantec.com/pgp page is gone. 
Linux1 app
GnuPG (gpg)
Open-source Run 'gpg --import yourkey.sec' and enter the passphrase to import the secret key. Technical details
deep spec| File encoding | ASCII-armored (Base64 + CRC24) or raw binary OpenPGP packet stream |
| ASCII armor header | `-----BEGIN PGP PRIVATE KEY BLOCK-----` at byte offset 0 |
| Container format | OpenPGP packet stream per RFC 4880 / RFC 9580 |
| Secret key protection | Passphrase-derived encryption via string-to-key (S2K) function; file is useless to an attacker without the passphrase |
| MIME type | application/pgp-keys |
| Byte order | Big-endian (OpenPGP multi-precision integers are stored big-endian) |
| Packet key versions | v3 (legacy), v4 (standard), v6 (introduced in RFC 9580, 2024) |
| Integrity check | CRC24 checksum embedded in ASCII armor; MDC or checksum over secret material in binary form |
| Typical file size | 1 KB - 20 KB per key block |
| Supported algorithms | RSA, DSA, Elgamal (legacy); ECDSA, ECDH, Ed25519/EdDSA (modern OpenPGP) |
| Operating systems | Windows, macOS, Linux |
| Key material compression | Secret key material itself is uncompressed; ASCII armor adds no compression layer |
| Modern successor | GnuPG stores secret keys in `private-keys-v1.d/` directory; `.sec` ring files are not created by default |
| Related extensions | .asc, .gpg, .pgp, .pkr, .skr, .key |
| Key pair role | Holds the secret (private) half of a PGP key pair; must never be shared or transmitted without passphrase protection |
| Released | PGP since 1991; OpenPGP standard RFC 4880 (2007), updated RFC 9580 (2024) |
| Latest version | OpenPGP RFC 9580 (2024) for the underlying key format |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
SEC conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about SEC files.
