Security Tool · Runs Offline
Lock a message to someone's public key so only the holder of the matching private key can open it — entirely inside this page. Paste the recipient's key, type your message, and copy out an armored block any mail client can carry. The cryptography is embedded in the file itself; save it, disconnect the network, and everything still works.
The Core Idea
Encryption keeps a message readable only by the person holding the matching private key. It needs no connection, no account, and no third party — only a public key and a browser.
Paste a recipient's public key and your message. Out comes an armored block only their private key can open.
Add your private key to prove who sent it. The reader learns both that the message is private and that it is really from you.
Given a message sent to you, unlock it with your private key — and check any signature it carries at the same time.
A message only its intended reader can open — with no service in the middle holding the key.
The Tool
Nothing entered below is transmitted anywhere. Keys, passphrases, and message text stay in browser memory and are gone when the tab closes — so copy or download anything you want to keep.
Encrypting to a public key means only the holder of the matching private key can read the result. Make sure the key is really the recipient's — for messaging ibCom, take the key and its DNS fingerprint from Connect.
Paste more than one key block to encrypt to several recipients — each of them will be able to open it.
Decrypting needs the private key the message was encrypted to, and its passphrase. Add the sender's public key to also confirm who signed it.
Under The Hood
The OpenPGP implementation is compiled into this page rather than fetched from a content delivery network. Once the HTML is on disk, the page has no runtime dependency on anything but the browser.
message · key · passphrase
v6.3.1 · embedded
crypto.getRandomValues · SubtleCrypto
copy · download · discard
— no fetch · no XHR · no websocket · no beacon —
crypto.getRandomValues.Handling
Confidentiality depends on who has which half of which key. Confusing them is the usual way a private message stops being private.
| Part | What it is | Who holds it | If it leaks |
|---|---|---|---|
| Recipient public key | The half you encrypt to. Publishable freely. | Anyone — the sender needs it. | No impact. Publication is the point. |
| Your private key | The half that decrypts. Passphrase-encrypted if you set one. | You alone. | Anyone can read messages sent to you. Revoke and issue a new key. |
| Passphrase | Unlocks the private key for use. | You alone — never with the key. | A stolen key file becomes immediately usable. Change it and re-key if in doubt. |
| The ciphertext | The armored message itself. | Anyone — it is meant to travel. | No impact today; but a private key stolen later still opens it. |
Confirm the recipient's key out of band. A public key that arrived over the same channel as your message proves nothing about who controls it. Verify the fingerprint through a channel you already trust, or against a DNS record on a domain the recipient controls — for ibCom, the key on Connect is pinned in a TXT record you can check with dig +short TXT pgp.ibcom.biz. The maths is not the weak point; key handling is.
Operating Rules
Encryption to the right key is trivial. Everything hard is about which key, held by whom.
Where It Fits
Public-key encryption is the cheapest confidential channel there is — no infrastructure, no shared secret to agree on first, no third party in the middle.
Send a sensitive report or disclosure without exposing it to your mail provider. Take the key from Connect, encrypt, and email the block to support@ibcom.biz.
Get findings to a team through a channel you do not fully control. Only the holder of the private key can read them, whatever handles the message in between.
Move a token, key, or config through email or chat without leaving it readable to every hop along the way.
An automated sender encrypts to a service key, so payloads stay private through forwarding, quoting, logging, and rendering.
Message-level encryption shares the instinct behind SSI: confidentiality rides on keys you hold, not on a platform account that has to still exist.
Encrypt here, gpg --decrypt there. Nothing here is a proprietary format.
Encryption you can run with the network off, producing messages only their intended reader can open — no service in the middle that has to still exist, and none that ever sees what you wrote.
Offline Use
Everything above works as loaded. The strongest version is a copy on a machine that has never touched a network — then the guarantee rests on a file you hold and can hash, not on trusting this site at the moment you happen to use it.
Press Ctrl/Cmd + S and choose "Webpage, HTML Only" — in Safari, "Page Source". Everything is inline, so the single .html is the whole tool. Avoid Chrome's "Single File" option: it writes .mhtml, which other browsers will not open.
curl -o entityos-send.html https://entityos.io/security/sendRecord the digest so you can tell later whether your copy changed, and confirm the OpenPGP.js banner comment near the end is intact.
shasum -a 256 entityos-send.htmlCopy the file to a USB stick and move it to the offline machine. That machine never needs a connection again — not to install anything, not to run this page, not to encrypt or decrypt.
Turn off Wi-Fi, or work on a machine that has never been connected. Double-click the file. It loads over file://, the fonts fall back to system defaults, and the tag in the header reads "Network off · still working". Every function behaves identically.
Do the work there. Paste the recipient key and message to produce ciphertext, or paste your private key and a message to open one. Copy or download the armored result.
Carry the encrypted block back to the networked world to send it. Keep your private key on the offline machine or on encrypted removable storage — a key that never touches a connected machine cannot be read off one.
Nothing about this page needs to be trusted on faith. It makes no network calls, stores nothing, and carries its own cryptography — so you can read it, hash it, keep it, and run it years from now on a machine with no internet at all.