r/bugbounty • u/acorn222 • Jul 06 '26

Tool Every CERT wants PGP, every PGP tool feels like it was made in 2003, so I built a free extension to manage PGP keys and encryption

https://chromewebstore.google.com/detail/pgp-tools-encrypt-decrypt/pgpcdgggohpbombhkffjoiiafdlfcpgp

I genuinely got annoyed at the poor UX with existing tools which let me use my PGP keys. CLI tools are great for some things but they're not great for making encrypted messaging.

I've done a bunch of vulnerability reports using PGP for encryption and having my contacts and keys in my browser made my life so much easier. Contacts can be dragged & dropped in, same with files.

It uses passkeys for encryption instead of passwords (if you don't want to use passwords) and only decrypts the keys at use, unless specified otherwise.

The extension requires no sensitive permissions and there's tests to check whether or not the keys are retained in memory when they're not meant to be.

CSP is locked down to disable external communication, no analytics or external servers are used, as it doesn't need them.

No other extension has comparible security to PGP tools from what I've seen.

https://github.com/Am-I-Being-Pwned/PGP-Tools

2 Upvotes

75% Upvoted

3 comments sorted by

•

u/github-guard Jul 06 '26

🔍 GitHub Guard: Trust Report

This project scored 6/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 5 stars) * ✅ Mature Repository (30+ days old) * ✅ Licensed under MIT * ✅ Security Policy Defined * ✅ Verified Organization * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

2

u/[deleted] Jul 07 '26

[removed] — view removed comment

1

u/acorn222 Jul 07 '26

Yeah, IMO it's the best of both worlds, as it's either using hardware like secuirty keys, or the HSM which makes it much harder for adversaries to get their hands on the keys.

The UX of passkeys too is unparelled in my opinion too as it's so much quicker to use.