Extensions in Tor Browser are a risk. Let me give you an actual threat model breakdown for mine rather than a sales pitch.
What it protects against:
- Accidental key exposure from pasting into websites or using web-based PGP tools (which can log your key material server-side)
- Keeping private keys in plaintext files that get swept up in accidental backups or syncs
- Forgetting to close decrypted content — the extension operates on text you paste in, not on ambient page content
What it does NOT protect against:
- A malicious update from me. This is real. Mitigations: pin a specific version, audit before updating, or don't use it at all.
- A compromised Firefox/Tor Browser installation — if the browser itself is compromised, extension-level isolation means nothing.
- Physical access attacks or memory forensics while keys are loaded.
- Weak master passwords — the AES-256 encryption protecting stored keys is only as strong as the password you choose.
Permission scope:
- storage — saves your keypairs, public keys, and encrypted master password data locally in the browser's extension storage. Nothing is sent anywhere.
- downloads — triggered only when you explicitly export a backup. It downloads an encrypted JSON file to your local disk. There is no background download activity.
No tabs, no activeTab, no webRequest, no <all_urls>. The extension cannot read or modify page content. Verify this yourself in manifest.json.
Recommended usage if you do install it:
- Enable a master password before importing any private key.
- Disable automatic updates for the extension and manually review GitHub diffs before updating.
- Use it on a dedicated browser profile or a persistent encrypted USB, not your daily Tor session.
- Never trust a key you haven't verified out-of-band.
Mozilla: https://addons.mozilla.org/en-US/firefox/addon/pgpsuite/
Source: https://github.com/ernos/pgpsuite-firefox-tor-extension
Website: https://www.yourdev.net/pgpsuite
I've written several articles on my blog about how malicious actors hide malware in extensions, and written a browser malware extension scanner available here:
https://github.com/ernos/browser-xpi-malware-scanner
Articles:
https://www.yourdev.net/blog.php?post=using-browser-xpi-extension-malware-scanner-and-exposing-malicious-youtube-downloader
https://www.yourdev.net/blog.php?post=supreme-adblocker-youtube-affiliate-fraud-complete-analysis
https://www.yourdev.net/blog.php?post=extension-malware-in-the-wild
Many of these infected extensions are still available for download on the addons.mozilla.org even though numerous emails from me warning them.
Hacking / Opsec
Honest threat model writeup for my OpenPGP Firefox/Tor extension called PGP Suite — including the risks
Started by codecave · Jul 18, 2026
Oi! people should not use this not simply because of trusting your code base and that it remains secure, but for the fact that adding an extra extension to tor is atrocious for OPSEC since it will fingerprint you and make you stand out against other tor users. Do not modify tor when using it other then security level and bridges, that is it! Cheers!
There's an even simpler reason for not installing it, it makes your fingerprint unique. You should make as few changes as possible to tor browser after you install it.
You always have the option to run this in a separate Firefox browser, which is what I would recommend for people without the necessary programming skills to themselves audit the code - for even further compartmentalization for security reasons.
This extension is an attempt to make it easier for people to come into and learn PGP and I think it is doing a good job at that. Maybe even arguable a too good job - since it is so simple even your grandma could understand it.
My goal when making this was to open up the world of PGP/darknet etc for a wider audience who doesn't have the technical know how or skills to do it. It's up to everyone themselves if it's worth it for their opsec needs.
My recommendation for people who have the opsec requirements of the above posters - which are 100% valid and I agree with them to some extent (although I use my own extension, obviously - because I trust myself, would probably audit the code and turn of automatic updates if it wasn't my own work) - Install it in a regular Firefox installation and use that in combination
I'm very active in the cybersecurity area of pretty much everything I can get my hands on - from reverse engineering and dumping firmware from microchips to cybersecurity in web extensions. I have written a pretty thourough and great scanner which scans for malware and malicious browser extensions which you can have a look at over at https://github.com/ernos/browser-xpi-malware-scanner
This extension is an attempt to make it easier for people to come into and learn PGP and I think it is doing a good job at that. Maybe even arguable a too good job - since it is so simple even your grandma could understand it.
My goal when making this was to open up the world of PGP/darknet etc for a wider audience who doesn't have the technical know how or skills to do it. It's up to everyone themselves if it's worth it for their opsec needs.
My recommendation for people who have the opsec requirements of the above posters - which are 100% valid and I agree with them to some extent (although I use my own extension, obviously - because I trust myself, would probably audit the code and turn of automatic updates if it wasn't my own work) - Install it in a regular Firefox installation and use that in combination
I'm very active in the cybersecurity area of pretty much everything I can get my hands on - from reverse engineering and dumping firmware from microchips to cybersecurity in web extensions. I have written a pretty thourough and great scanner which scans for malware and malicious browser extensions which you can have a look at over at https://github.com/ernos/browser-xpi-malware-scanner
I addressed this in a previous post and the answer for this is to install it in a regular firefox browser and use it in combination with your Tor browser.
This extensions target audience is people who want to get into the darknet world - but the technical hurdles are too big for them to overcome. I thought this extension might help with that.
All of your concerns are 100% valid and if your opsec needs are way up there in your top 2 priorities list - then go ahead and install it in fresh firefox profile which you only use for this - and use it in combination with your Tor Browser.
Or do not use it at all. As I said. Target audience is people who want to get into the darknet world but do not have the technical skills or know how to do so. This is just a way for make this gap a bit easier for them to overcome, and I hope I can help at least a handful of people with this - if so - I consider this project a success.
This extensions target audience is people who want to get into the darknet world - but the technical hurdles are too big for them to overcome. I thought this extension might help with that.
All of your concerns are 100% valid and if your opsec needs are way up there in your top 2 priorities list - then go ahead and install it in fresh firefox profile which you only use for this - and use it in combination with your Tor Browser.
Or do not use it at all. As I said. Target audience is people who want to get into the darknet world but do not have the technical skills or know how to do so. This is just a way for make this gap a bit easier for them to overcome, and I hope I can help at least a handful of people with this - if so - I consider this project a success.
Oh no no I didn't mean it like that. This is for sure a great idea. I never understood anyways why pgp isn't used by everyone. People act like it's some super complicated concept. But I guess with a simpler browser extension it would help a lot for people to learn this. I was just saying, if you are super duper paranoid and have a big threat level, it would probably be better to not use it in a browser extension you know? For me, I'm super paranoid. I run a VM for literally every separate application so there is almost no attack surface.
But yeah, I get your idea on trying to make pgp more popular and honestly I salute this. There is need for more privacy aware people in general public, even if they don't commit any crimes or hacktivism or are not endangered journalists. So yeah, great thing you are doing! I will look at the extension as well once I get some free time :)
But yeah, I get your idea on trying to make pgp more popular and honestly I salute this. There is need for more privacy aware people in general public, even if they don't commit any crimes or hacktivism or are not endangered journalists. So yeah, great thing you are doing! I will look at the extension as well once I get some free time :)
If you run it in a separate browser profile, what's the use case over a more mature, trusted, and lighter pgp frontend like kleopatra? We both know that most new users will just install it on their primary profile, which comprises their privacy.