u/PriorityIcy8541

GitHub (free, MIT licensed): https://github.com/Nothingman333/pgp-for-web-chats

Been following the Chat Control situation here for a while and wanted to do something practical instead of just doomscrolling about it. This won't fix the legislation, but if a message is PGP-encrypted client-side before it ever leaves your browser, scanning the platform's copy of it doesn't reveal anything.

It's a browser extension that adds a lock button next to the message box on WhatsApp Web, Discord, Gmail, or pretty much any chat site. Encrypts to a saved contact's key before sending, decrypts automatically on the other end. No server, no account, everything happens locally.

Not pretending this is a silver bullet: metadata (who's talking to whom) is still visible to the platform, messages aren't signed yet, and it hasn't had a professional security audit. Full list of limitations is in the README, didn't want to oversell it. It's meant as a practical layer on top of the apps people already use with the people they already talk to, not a replacement for Signal if you need something audited.

Not on the Chrome Web Store yet, install instructions (takes about a minute) are in the repo.

GitHub: https://github.com/Nothingman333/pgp-for-web-chats

Not on the Chrome Web Store yet (no dev account), so for now it's install-as-unpacked: download the ZIP from the Releases page, chrome://extensions, enable Developer mode, Load unpacked.

What it does: puts a small lock button next to the text box on any site. Pick a saved contact, write your message, it gets PGP-encrypted before it's inserted. On WhatsApp/Discord/Slack/Telegram it sends automatically, elsewhere it just fills the box and you send manually. The other person, running the same extension, sees it decrypt automatically with a colored dot showing the status.

Manifest V3, no background network calls, no analytics. Private key can optionally be locked behind a password (PBKDF2 + AES-256-GCM), off by default. Uses OpenPGP.js.

It's a side project, not audited, no message signing yet - the README lists what it doesn't do so nobody gets a false sense of security. Happy to answer questions about the implementation, and bug reports for sites where the message box detection doesn't work are very welcome.