PGP has a reputation for being difficult, and most of that reputation comes from the setup rather than the cryptography. You can use the same standard and the same cipher from a browser tab, with no install and no keyring. Here is how that works, what you give up, and when you should reach for the desktop tools instead.
What changes without an install
Nothing about the format. A message encrypted in a browser with OpenPGP.js is an ordinary OpenPGP message: it opens in GnuPG on the command line, in Kleopatra on Windows, in whatever your correspondent already uses. The interoperability is the same because the standard is the same.
What changes is where the code runs and what it has access to. Desktop GnuPG runs as a native process with a keyring on disk. A browser tool runs as JavaScript in a tab, with no persistent key storage at all.
Two ways to encrypt without keys
Password-based (symmetric)
You choose a password, the message is encrypted with it, and anyone with that password can decrypt it. No keypairs, no key exchange, nothing to set up in advance. This is what most people want for a one-off: sending a colleague a credential, sending a friend an address.
The catch is that the password has to reach the recipient somehow, and it must not travel alongside the message. That single requirement is where most real-world mistakes happen β we cover it properly here.
Public key
If your recipient already has a PGP public key, you can encrypt to it directly and skip the shared-password problem entirely. Only the holder of the matching private key can decrypt the result, so there is no secret to transmit. CrypClip supports this under Advanced Options.
This is strictly better when it is available. It is just rarely available, because it requires the other person to already have a keypair.
The honest limitations
A browser tool is not a drop-in replacement for a desktop PGP setup, and it is worth being clear about where the gaps are.
No key management
There is no keyring, no key generation, no trust model, no expiry handling. If you need to manage identities over time β the thing PGP was actually designed for β you want GnuPG.
No signing
Encryption proves nobody else can read the message. It does not prove who sent it. Signing does, and browser tools generally do not offer it. If authenticity matters as much as secrecy, that gap is significant.
A larger attack surface
Code delivered over the network at page load can, in principle, be tampered with β by a compromised server, or by a malicious browser extension with access to the page. Desktop software you installed once and verified does not have that property. This is the real trade-off, and it is not zero.
Password-based encryption is only as strong as the password
AES-256 is not the weak point. An eight-character password is. Symmetric PGP derives its key from your passphrase, so a guessable one can be attacked offline by anyone holding the ciphertext, no matter how strong the cipher underneath.
How to check the claims rather than trust them
Any tool can assert that it does not send your data anywhere. The useful question is whether you can confirm it.
With a browser tool you can, and it takes a minute: open your browser's network tab and encrypt something β you should see no outbound request carrying your text. Or disconnect from the network entirely and encrypt anyway; if it still works, nothing was being sent. CrypClip is also shipped unminified specifically so the JavaScript can be read, and the how-it-works page walks through each check.
That verifiability is the compensation for the larger attack surface. You cannot audit a desktop binary that easily either β but you also do not re-download it on every use.
So which should you use?
Use a browser tool when you need to send one message to one person and the alternative is sending it unencrypted. That is a genuine improvement, and it is the common case.
Use GnuPG when you are managing keys over time, when you need signatures, or when your threat model includes a well-resourced adversary who might target the delivery of the page itself. We go through that comparison in detail in CrypClip vs the GPG command line.