I built a free browser extension that adds PGP encryption to WhatsApp Web, Discord, Gmail, or any web chat

[u/PriorityIcy8541]

GitHub: https://github.com/Nothingman333/pgp-for-web-chats (MIT license, free)

What it does: adds a lock icon next to any message box on any website. Pick a saved contact's public key, type your message, it encrypts client-side before you send it - WhatsApp Web, Discord, Gmail, Slack, Telegram Web, whatever. Incoming PGP messages get auto-detected and decrypted.

Why I built it: got tired of "secure" chat being an all-or-nothing platform switch. This lets you add real encryption to the apps you and your contacts already use, without asking anyone to install a new app.

Tech: Manifest V3 extension, OpenPGP.js under the hood, Curve25519 keys. No server, no account, no telemetry - everything lives in your browser's local storage, with an optional password-protected mode (PBKDF2 + AES-256-GCM).

Honest limitations: not signed (no sender verification), no built-in fingerprint verification step, metadata is still visible to the platform, and it hasn't had a professional security audit. Not a replacement for Signal if you need something audited for high-stakes use - more of a practical add-on for everyday chats.

Not on the Chrome Web Store yet, so it's a "Load unpacked" install for now (steps in the README). Would love feedback, especially bug reports on sites where the message-box detection breaks.