Is there a better way to compress and then encrypt files other than tar followed by openssl or gpg?

  • 3
    That depends. What are your requirements? How are you quantifying "best"? What tools do you have available? Have you considered any other options already that might be useful to mention? Jul 14, 2014 at 1:48
  • Haven't considered any others. It just needs to be basic encryption, where someone can't read the contents of the file, and preferably maintain a good compression ratio.
    – user75027
    Jul 14, 2014 at 2:18
  • 1
    Generally the answer will be no. One of the core unix philosophies is "do one thing and do it well". tar -z is a slight exception because it is a very common practice.
    – phemmer
    Jul 14, 2014 at 4:19
  • 1
    Newer tar versions support xz compression (flag -J) whose compression ratio is usually better than the more traditional gzip (-z) or bzip2 (-j) compression.
    – jofel
    Jul 14, 2014 at 8:24
  • I've noticed that xz is excellent. I do remember downloading the kernel and it was zipped to about 1/7 of its original size. I guess I'll tar cvJf out.tar.xz file1 [file2...] and then use gpg or openssl to encrypt it. I also notice that xz is very fast. How does it acheive better compression than bz2 and still be fast?
    – user75027
    Jul 14, 2014 at 15:40

3 Answers 3


tar is the usual tool to bundle files. Plain tar itself doesn't compress. There are separate tools such as gzip, bzip2 and xz (in increasing order of compression ratio on typical files) that compress one file. Many tar implementation, including GNU tar (the normal implementation on Linux), can automatically compress with an option (-z for gzip, -j for bzip2, -J for xz):

tar -cJf myarchive.tar.xz file1 file2 file3

To encrypt a file, use gpg. Create a key and associate it with your email address (GPG/PGP key identifiers usually contain an email address, though it is not necessary ). Encrypt your files, specifying your email as the recipient. To decrypt a file, you'll need to enter the passphrase to unlock your private key.

GPG also lets you encrypt a file with a password. This is less secure and less flexible. It's less flexible because you need to specify the password when encrypting (so for example you can't make unattended backups). It's less secure because the only security is the password, whereas key-based encryption splits the security between the password and the key.

Don't use the openssl command line tool. It's a showcase for the OpenSSL library, not designed for production use. Although you can do some things with it (in particular, it does have all the primitives needed for a basic certification authority), it's hard to use correctly and it doesn't have all you need to do things right. Where GPG gives you a bicycle, OpenSSL gives you some metal rods of various sizes and a couple of rubber chambers (screws and pump not included). Use GPG.

  • I understand tar as a bundler and the methods of compression. gpg keys, however, are new to me. I don't exactly understand how to use it, although I do have a key. I think. I think I also have ssh keys.
    – user75027
    Jul 15, 2014 at 16:43
  • This is what I was looking for to compress and encrypt with one command (using tar and gpg in a pipe). Jan 19, 2019 at 19:49

You can use 7zip:

7z a -p -mhe=on stuff.7z MyStuff
   ^  ^     ^      ^        ^
   |  |     |      |        `--- Files/directories to compress & encrypt.
   |  |     |      `--- Output filename
   |  |      `--- Encrypt filenames
   |  `---- Use a password
   `---- Add files to archive

It will prompt you for a password. Apparently it uses AES-256 for encryption and SHA-256 of the password and a counter repeated 512K times for key derivation.


So you can use 7zip encrypting file names too:

7z a -p -mhe=on stuff.7z MyStuff

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .