Email Encryption

A normal email is about as private as a postcard: anyone who gets their hands on it in transit can read along. Email Encryption puts your message into an envelope that only the right recipient can open. The content becomes unreadable to everyone else - to the mail provider, to eavesdroppers on the network, to anyone without the matching key.

Technically this is a hybrid scheme, the kind the security world has used for decades. Your actual message is encrypted with AES-256-GCM, a fast and very secure symmetric method. The key needed for that is in turn encrypted with RSA-OAEP using the recipient's public key. So you get the best of both worlds: the speed of AES and the key distribution of RSA.

It all starts with your key pair, which you generate right in the tool - with 2048 or 4096 bits. The public key may and should be passed around: anyone who wants to write to you encrypts with it. The private key stays secret with you and is the only thing that can decrypt a message addressed to you.

Alongside encryption there are digital signatures. You sign a message with your private key, and anyone can verify with your public key that it really came from you and was not altered on the way. Encryption protects the content, the signature protects authenticity - together that makes real confidentiality.

The key management keeps your contacts' public keys in one place and shows a fingerprint for each, so you can check that you really have the right key. Because encryption is only as good as the certainty that the public key truly belongs to who you think it does.

The crucial point: all cryptographic operations run through your browser's Web Crypto API, so locally on your device. Your private key and your plaintext are never sent to a server. The tool uses its own, clearly recognizable format for encrypted and signed blocks - designed for communication between people who use this tool, not as a replacement for an existing GnuPG setup.