Signing GitHub commits with a GPG key

Updated in September 2026. GitHub also supports SSH and S/MIME commit signatures; use the method that fits your existing key management.

Generate the GPG key

Follow GitHub's current guide for generating a new GPG key, including a verified email address that matches your Git commits.

gpg --full-generate-key

gpg --list-secret-keys --keyid-format=long

gpg --armor --export <key-id>

Add only the armored public key to GitHub under Settings → SSH and GPG keys.

Configure Git to sign commits

git config --global user.signingkey <key-id>
git config --global commit.gpgsign true

Create a test commit and confirm that GitHub shows it as verified. If Git cannot prompt for the passphrase, configure gpg-agent for your operating system rather than removing the passphrase.

Moving a private key

A private signing key is a credential. Prefer generating a separate key per device. If you must transfer one, export it to encrypted removable storage or through a verified encrypted channel, import it on the destination, and securely remove the temporary export.

gpg --armor --export-secret-keys <key-id> > private-signing-key.asc
gpg --import private-signing-key.asc

Never send the exported file to GitHub or commit it to a repository. Remove the temporary file after verifying the destination and keep a protected recovery backup.

Existing commits

Signing applies to new commits. Rewriting old commits changes their hashes and can disrupt every collaborator and reference to that history, so avoid it on shared branches. GitHub's commit-signing documentation covers current signing options.