Hacker Newsnew | past | comments | ask | show | jobs | submit | athanasiosem's commentslogin

I am the author of PGPkeygenerator.com — a client-side PGP key generator that runs entirely in the browser (no server, no tracking, keys never leave your machine).

With Chrome's new WebMCP API (navigator.modelContext) landing in Canary, I added a generate_pgp_keys tool registration so AI agents can invoke it directly from the browser without any backend or API key.

How it works:

1. The page registers a generate_pgp_keys tool via navigator.modelContext.registerTool() 2. The tool accepts name, email, and optional parameters (type, keySize, passphrase, expirationTime) 3. It populates the form, calls the existing key generation logic (OpenPGP.js), and returns all three PGP blocks (private key, public key, revocation certificate) as the tool response

To try it:

1. Enable chrome://flags#webmcp-for-testing in Chrome Canary (146+) 2. Install the Model Context Tool Inspector extension 3. Open pgpkeygenerator.com. The generate_pgp_keys tool should appear in the inspector — invoke it with { "name": "Alice Smith", "email": "alice@example.com" }

Source: github.com/athanasiosem/pgpkeygenerator.com


Hello and thanks for your comment.

You can unplug your Ethernet cable after you loaded the website and still generate a key.

While offline key generation may offer an additional layer of security, online services can provide a more accessible and user-friendly option for individuals who prioritize convenience and still want a reasonable level of security.


Hello and thanks for your comment.

1. All online key generators should be approached with caution, however they can be a practical solution for users who may not be comfortable with offline key generation or lack technical expertise.

2. The code is run on the client-side. I do not have any third party code running - I have removed the Google Analytics code. This setup provides a reasonable level of security for many users. If you are that hardcore you can still use offline key generation but don't discourage users with blanket statements like 'do not use online services'.


Hello and thanks for your comment. I appreciate your feedback and have removed the third-party analytics code to enhance security and privacy.



Just a small script I wrote yesterday night. Tries to guess the operating system of the IP given using the TTL reply of ping. The results are valid only if default TTL value has not been changed.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: