What a "PGP SIM" really is (and what it is not)

People ask us what a "PGP SIM" actually is, so here is the short, honest version from the Ghost SIMs team.

PGP and SIM cards live on different layers#

PGP (today usually OpenPGP, defined in RFC 9580) is a way to encrypt and sign messages and files with a public and private key. It works inside apps: an email client, a file tool, a messenger that supports it. Nothing in the OpenPGP spec talks about cellular networks.

A SIM does a different job. It authenticates a subscription to a mobile network. The network still sees things like the subscriber identity (IMSI), the device (IMEI), which cell you are near and when you connect.

So encrypting your email with PGP does not hide your SIM from the network, and a SIM cannot magically PGP-encrypt your calls.

So what does "PGP SIM" mean in practice?#

In the market, "PGP SIM" is mostly a label for a privacy-focused SIM or eSIM service. Depending on the provider, that can mean:

• multi-IMSI profiles, so one identifier is not used everywhere for years
• international roaming and provider-selected routing
• fewer identity documents at purchase
• the provider's own data-retention policy
• bundled secure apps for the actual end-to-end encrypted messaging

Each of those addresses a slice of the threat model. None of them makes a phone invisible. Location patterns, timing, device identifiers and your own account logins can still link activity together.

A sensible setup#

If you care about mobile privacy, think in layers:

1. Content: use an end-to-end encrypted messenger (Signal, Threema and similar) or OpenPGP where it fits.
2. Device: a hardened OS such as GrapheneOS on a supported Pixel, kept up to date.
3. Network identity: a SIM or eSIM service whose identity and routing model you understand.
4. Habits: separate numbers for separate parts of your life, and no reuse of accounts that tie it all back to you.

Questions worth asking any provider#

• Is PGP actually used anywhere, and by which app?
• How does IMSI switching work, and what does it not protect?
• What is logged, and for how long?
• Which countries and networks does it work on?

We wrote a longer explainer covering application-layer PGP versus network-layer privacy, IMSI management and who actually needs this kind of SIM: PGP SIM card explained.

Disclosure: this note is published by Ghost SIMs (ghostsims.com), which sells privacy-focused SIMs and eSIMs. Questions are welcome.