# Crypt3TR

> Encrypt and decrypt text directly in your browser, on any site or webmail. Crypt3TR uses a shared password and modern client-side encryption to protect your messages without complex configuration.

Canonical page: [https://chrome-stats.com/d/crypt3tr](https://chrome-stats.com/d/crypt3tr)

## Overview

- **ID:** `crypt3tr`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** TBDwarf
- **Category:** privacy-security,social-communication
- **Version:** 1.3
- **Last updated:** 2025-12-23
- **First published:** 2025-12-01
- **Size:** 64 KB
- **Data as of:** 2026-09-15
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/crypt3tr/)
- **Website:** [https://github.com/TBDwarf/Crypt3TR](https://github.com/TBDwarf/Crypt3TR)
- **Privacy policy:** [https://addons.mozilla.org/firefox/addon/crypt3tr/privacy/](https://addons.mozilla.org/firefox/addon/crypt3tr/privacy/)

## Description

Crypt3TR is an <strong>open source</strong> Firefox extension that allows you to <strong>encrypt and decrypt text directly in your browser</strong>, on virtually any site: webmails, forums, social networks, web messengers, wikis, forms…

🎯 <strong>Goal:</strong> make message encryption <strong>simple, fast, and accessible</strong>, without complexity or public/private key management.

✨ Main features:
<ul><li>🔒 <strong>100% client-side encryption / decryption</strong>
  -- Everything happens in your browser, without an intermediary server.
  -- Pages <strong>never</strong> see the plaintext: only <code>[[crypt3tr]]…[[/crypt3tr]]</code> blocks.</li><li>🖱️ <strong>Unified "Crypt3TR" contextual menu</strong>
  -- Right-click in a text area → <strong>Crypt3TR Encryption</strong>.
  -- Opens a <strong>secure editor</strong> (within an extension iframe) to write or re-edit the message.
  -- Upon return, only the <strong>encrypted</strong> text is inserted into the page (never the plaintext).</li><li>👁️ <strong>Decrypted display via a secure viewer</strong>
  -- Encrypted blocks on the page are automatically replaced by a <strong>dedicated viewer</strong> (extension iframe).
  -- Visual "dissolve" effect from base64 to plaintext.
  -- The decrypted text remains <strong>confined within the extension iframe</strong>, outside the page's DOM.</li><li>🌐 <strong>Domain whitelist</strong>
  -- Limit the extension to the sites you choose (webmail, chat, forum, etc.).  </li><li>📝 <strong>Support for numerous fields</strong>
  -- <code>&lt;textarea&gt;</code>
  -- <code>&lt;input&gt;</code> (text, email, etc.)
  -- <code>contentEditable</code> elements (rich editors)
  -- Certain <strong>Shadow DOM</strong> content (modern webapps)
  -- Specific integration for <strong>Discord</strong>, WhatsApp Web, Gmail, etc.</li><li>🌍 <strong>Bilingual FR / EN interface</strong>  </li><li>🧩 <strong>No data collection, no tracking</strong>
  -- No account, no registration, no server: everything is <strong>100% local</strong>.  </li></ul>
🧰 Typical use cases:
<ul><li>Protect your <strong>email</strong> content on webmails  </li><li>Send <strong>confidential messages</strong> via a forum or web chat  </li><li>Encrypt <strong>sensitive notes</strong> before posting or storing them online  </li><li>Share a <strong>password</strong> or <strong>access code</strong> more securely  </li></ul>
✅ For the recipient to read your encrypted messages, they simply need to:
<ol><li>Install the <strong>Crypt3TR</strong> extension  </li><li>Enter the <strong>same password</strong> in the extension  </li><li>Open the page containing the message: the viewer automatically displays the decrypted version (if the domain is authorized).</li></ol>
🛡️ Security, DOM &amp; internal workings:

<strong>Protection against DOM reading</strong>
<ul><li>Plaintext <strong>no longer passes through the page's DOM</strong>:
  -- it does not appear in <code>&lt;input&gt;</code>, <code>&lt;textarea&gt;</code>, or <code>contentEditable</code> in readable form,
  -- it is not visible via "Inspect Element" or through third-party scripts reading the DOM.  </li><li>Editing takes place in a <strong>dedicated editor</strong> (extension iframe), isolated from the page context.  </li><li>Reading takes place in a <strong>dedicated viewer</strong> (another extension iframe).  </li><li>A malicious script injected into the page (XSS, third-party script, another extension) only sees:
  -- <code>[[crypt3tr]]BASE64[[/crypt3tr]]</code> blocks in the DOM,
  -- or the reading iframe, but <strong>without access to internal content</strong>, thanks to extension isolation.</li></ul>
<strong>Message encryption</strong>
<ul><li>Algorithm: <strong>AES-256-GCM</strong>  </li><li>Key derivation: <strong>PBKDF2-SHA256, 500,000 iterations</strong>, with 128-bit random salt  </li><li>IV: 96-bit random  </li></ul>
The text is encrypted with a key derived from your password. Anyone with the <strong>same password</strong> and the extension can decrypt these blocks.

<strong>Secure password storage</strong>
<ul><li>Your password is <strong>never stored in plaintext</strong>.  </li><li>It is encrypted with a <strong>non-extractable AES-GCM master key</strong>, generated and stored in the extension (IndexedDB).  </li><li>This master key is never exported and remains within the <strong>extension's secure context</strong>.  </li><li>The password is only used in memory to encrypt/decrypt your messages.</li></ul>
⚠️ Limitations &amp; threat model:

Crypt3TR <strong>does not protect</strong> against:
<ul><li><strong>keyloggers</strong>, malware, or a compromised operating system,  </li><li><strong>other malicious extensions</strong> capable of directly reading your keystrokes or breaking extension isolation (very high threat model),  </li></ul>
Real security also depends on:
- <strong>password quality</strong> (long, unique, complex),
- <strong>machine reliability</strong> (uninfected PC, healthy browser).

✅ Recommended best practices:
<ul><li>Use a <strong>long and unique password</strong> (20+ characters, letters + numbers + symbols).  </li><li>Share this password via a <strong>secure channel</strong> (Signal, physical meeting, etc.).  </li><li>Restrict the <strong>whitelist</strong> to sites where you actually need encryption.  </li><li>Avoid using Crypt3TR on <strong>public</strong> or untrusted machines.</li></ul>
🧑‍💻 Source code &amp; contributions:
<ul><li>🔓 Source code: &lt;<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/2d04c9e9c8d092e7881b6c34eaa8dcfeeb2e29d3e22e78336485a7085b705d7e/https%3A//github.com/TBDwarf/Crypt3TR" rel="nofollow">https://github.com/TBDwarf/Crypt3TR</a>&gt;  </li><li>📜 License: <strong>Apache-2.0</strong>  </li></ul>
Crypt3TR aims to offer <strong>simple, convenient, and transparent encryption</strong> for your everyday web messages, while remaining <strong>respectful of your privacy</strong>, and protecting you as much as possible from scripts that read the DOM of pages.

## Rankings

- #144,281 — Overall
- #174 — encrypt
- #209 — crypto
- #214 — messenger
- #250 — password-protected

## Permissions and access

### Permissions

- `storage`
- `menus`
- `contextMenus`
- `<all_urls>`

### Content script matches

- `<all_urls>`

## Safety

- **Risk impact:** Moderate risk impact
- **Risk likelihood:** Moderate risk likelihood

### Analysis details

- Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site.
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [CryptoData](https://chrome-stats.com/d/crypto-data) — 290 users, 4.22 / 5
- [Cryptor](https://chrome-stats.com/d/cryptor) — 3 users
- [Crypto Sender](https://chrome-stats.com/d/crypto-sender) — 1 users, 5.00 / 5
- [ΤRОɴ Web3](https://chrome-stats.com/d/%CF%84r%D0%BE%C9%B4-web3)
- [Cipher](https://chrome-stats.com/d/cipher) — 3 users
- [Pcrypt](https://chrome-stats.com/d/pcrypt) — 8 users, 5.00 / 5
- [Enigma 2.0](https://chrome-stats.com/d/enigma-2-0) — 2 users
- [Text Encryptor](https://chrome-stats.com/d/text-encryptor) — 4 users, 1.00 / 5
- [SimpleDiscordCrypt](https://chrome-stats.com/d/simplediscordcrypt) — 66 users, 5.00 / 5
- [CS Encryptor](https://chrome-stats.com/d/cs-encryptor) — 2 users, 5.00 / 5
- [PGP Suite – Encrypt Messages & Files](https://chrome-stats.com/d/openpgp) — 25 users, 4.87 / 5
- [Encryption Tool](https://chrome-stats.com/d/text-encryption-tool) — 94 users, 4.43 / 5

---

Source: [Chrome-Stats](https://chrome-stats.com/d/crypt3tr)