Chrome Web Store
54Versions
1Code reviewed

No malware found

In code review (v8.5.13)

Our reviewer read version 8.5.13 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

FlowCrypt: Encrypt Gmail with PGP, used by 80,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

FlowCrypt is a well-known open-source PGP encryption extension for Gmail with 80k+ users and a 4.7 rating. The required permissions (scripting, identity, tabs, etc.) are essential for its core functionality: injecting a secure compose UI into Gmail, authenticating via OAuth, and accessing email APIs. All outbound network communication is to first-party or necessary service domains (, Google APIs, Microsoft Graph) and falls within the disclosed 'Personally identifiable information' data collection category. The ML model false positive is explained by broad permissions, large minified libraries (, emailjs), and expected UI operations (innerHTML, appendChild). No evidence of data exfiltration, tracking to undisclosed third parties, or malicious code injection was found.

FlowCrypt: Encrypt Gmail with PGP

FlowCrypt: Encrypt Gmail with PGP Chrome extension security report

ID: bnjglocicdkmhmoohhfkfkbbkejdhdgc

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
8.5.15
Size
3.82 MB
Rating
4.7/5
Reviews
360
Users
80,000
Type
Extension
Updated
Sep 18, 2026
Category
Communication
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
1extension
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
FlowCrypt a. s.
MX records exist
No
Domain exists
No
Is disposable
No
Is role-based
No
Mailbox exists
No
Website
Visit
Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Users
80,000

Email Change History

1 change
Feb 7, 2024

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
identity
Permission
High
This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 19% increase: Access to sensitive domains increases potential impact
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
https://flowcrypt.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://outlook.live.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://outlook.office365.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://outlook.office.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://graph.microsoft.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://login.microsoftonline.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.googleapis.com/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://*.google.com/*, https://outlook.live.com/*, https://outlook.office365.com/*, https://outlook.office.com/*, https://www.googleapis.com/*
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

Simple end-to-end encryption to secure email and attachments on Google.

Read the publisher’s full description

🟢 A simple end-to-end encryption to secure your emails and attachments on Google, including Google Workspace, Business, and Enterprise using OpenPGP. 🟢 FlowCrypt lets you use PGP encryption by generating a private and public key. It uses the recipient’s public key to encrypt the email, and only the recipient’s private key can decrypt the message and reveal its content. 🟢 Adds a Secure Compose button to Gmail, allowing you to send private PGP-encrypted emails when you choose to. 🟢 We update the extension regularly (see the "Updated" field to the right). FlowCrypt allows you to: ✔ Set up the extension in just a few clicks. ✔ Generate private keys using the ECC and RSA (up to 4096-bit) algorithms. ✔ Use FlowCrypt’s own Attester public key server. ✔ Send and receive encrypted emails and attachments (up to 25MB, with previewing functionality) to anyone. ✔ Send and receive encrypted emails directly or through Encrypted Contact Page. ✔ Send password-protected emails to the recipient who doesn’t have any OpenPGP software (as well as receive such emails). ✔ Sign encrypted emails to let your recipients verify that the message is from you and that the content hasn’t been modified. 🌐 Website: https://flowcrypt.com/ 📁 Source code: https://github.com/FlowCrypt/ 📚 Documentation: https://flowcrypt.com/docs/ 🧠 Knowledge Base: https://flowcrypt.com/blog/questions/ 📱 Android & iOS apps: https://flowcrypt.com/download 📩 Looking forward to your feedback! Please email us at human@flowcrypt.com.

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
8.5.15
Latest
3.82 MBNot scanned—
bdcc862ba868405ce7cfc09505addf5941539fba6a8249b1ff655454b46e5cff
8.5.14
3.65 MBNot scanned—
bdcc862ba868405ce7cfc09505addf5941539fba6a8249b1ff655454b46e5cff
8.5.13
3.64 MBNo malware found0
bdcc862ba868405ce7cfc09505addf5941539fba6a8249b1ff655454b46e5cff
8.5.12
3.63 MBNot scanned—
bdcc862ba868405ce7cfc09505addf5941539fba6a8249b1ff655454b46e5cff
8.5.8
3.29 MBNot scanned—
bdcc862ba868405ce7cfc09505addf5941539fba6a8249b1ff655454b46e5cff
8.5.7
3.39 MBNot scanned—
e9bc1d1ed97455c9b68d468026142cf7f900f991baf812dcbee167894d5687e4
8.5.6
3.39 MBNot scanned—
e9bc1d1ed97455c9b68d468026142cf7f900f991baf812dcbee167894d5687e4
8.5.5
3.38 MBNot scanned—
e9bc1d1ed97455c9b68d468026142cf7f900f991baf812dcbee167894d5687e4
8.5.4
3.01 MBNot scanned—
e404c5483f2113bca2ca0c50870172d00108f861f7fe2410c87d9b9090f01918
8.5.3
3.01 MBNot scanned—
e404c5483f2113bca2ca0c50870172d00108f861f7fe2410c87d9b9090f01918
Showing 1 to 10 of 60 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Popular in Communication