Email Encryption

A normal email is about as private as a postcard: anyone who gets their hands on it in transit can read along. Email Encryption puts your message into an envelope that only the right recipient can open. The content becomes unreadable to everyone else - to the mail provider, to eavesdroppers on the network, to anyone without the matching key.

Technically this is a hybrid scheme, the kind the security world has used for decades. Your actual message is encrypted with AES-256-GCM, a fast and very secure symmetric method. The key needed for that is in turn encrypted with RSA-OAEP using the recipient's public key. So you get the best of both worlds: the speed of AES and the key distribution of RSA.

It all starts with your own key, created by your browser - with 2048 or 4096 bits, one key pair to encrypt and one to sign. The public keys may and should be passed around: anyone who wants to write to you encrypts with them. The private keys are encrypted with your passphrase and live in this browser only. Back them up as a file, because without them no message addressed to you can be opened again.

Alongside encryption there are digital signatures (RSA-PSS). You sign a message with your private key, and anyone can verify with your public key that it really came from you and was not altered on the way. Encryption protects the content, the signature protects authenticity.

The key management keeps your contacts' public keys in one place and shows a fingerprint for each, so you can check that you really have the right key. Because encryption is only as good as the certainty that the public key truly belongs to who you think it does.

The crucial point: all cryptographic operations run through your browser's Web Crypto API, so locally on your device. Your private key, your passphrase and your plaintext are never sent to a server, and messages are not saved as drafts. The format is Werkzeu.ge's own: not OpenPGP, not S/MIME. Thunderbird, Outlook or GnuPG cannot open it, both sides need Werkzeu.ge.