Next PGP

Next PGP is an elegant, powerful, and modern Progressive Web App (PWA) built with Next.js. It provides an app-like experience for generating OpenPGP keys, managing keyrings, and securely encrypting and decrypting messages and files with zero-knowledge architecture.

---

🚀 Key Features

• Advanced Key Generation:
  • Effortlessly generate cryptographically secure PGP keys.
  • Supports modern elliptic curve and legacy algorithms:
    • Curve25519 (EdDSA/ECDH) — Recommended
    • NIST P-256, P-521 (ECDSA/ECDH)
    • Brainpool P-256r1, P-512r1 (ECDSA/ECDH)
    • RSA 2048, 3072, 4096
• Comprehensive Keyring Management:
  • Add, manage, delete, import, export, and backup keys.
  • Query, import, and publish public keys via public PGP keyservers (HKP).
  • Add, modify, or strip key passphrases.
  • Manage and revoke User IDs and subkeys.
• Encryption & Decryption Suite:
  • Asymmetric and symmetric text message encryption and decryption.
  • Single file encryption and decryption with integrity verification.
  • Batch File Processing: Process multiple files simultaneously with distinct recipient keys.
  • Folder Recursion: Recursively encrypt and decrypt entire folder structures, preserving internal paths.
• Zero-Knowledge Cloud Vaults:
  • End-to-end encrypted remote key backups.
  • Password-derived keys using PBKDF2 (1,000,000 iterations, SHA-512) and AES-256-GCM.
  • Server-opaque verificationCipher — passwords and private keys are never transmitted to or readable by the server.
• Multithreaded Web Worker Pool:
  • Dynamic worker pool automatically scales cryptographic tasks across all available CPU cores via navigator.hardwareConcurrency.
  • Keeps the interface reactive at 60 FPS even during heavy batch operations.
• Cross-Platform Progressive Web App (PWA):
  • Installable on macOS, Windows, Linux, Android, and iOS with offline support.

---

⚡ Quick Start

Prerequisites

• Node.js: 22.x (enforced via .nvmrc)
• Package Manager: pnpm (>= 9.x or 11.x)
• PostgreSQL & Redis

Installation & Local Run

# 1. Clone repository
git clone https://github.com/xbeast1/NextPGP.git
cd NextPGP

# 2. Install dependencies (triggers Prisma client generation)
pnpm install

# 3. Configure environment variables
cp .env.example .env
# Edit .env and supply your DATABASE_URL, REDIS_URL, and AUTH_SECRET

# 4. Push database schema
pnpm prisma db push

# 5. Generate local SSL certificates for Web Crypto API support
pnpm setup:https

# 6. Start HTTPS development server
pnpm dev:https

Visit https://nextpgp-dev.com:3000 in your browser.

Note

For a detailed guide on setting up custom host mappings, resolving certificate warnings, and troubleshooting, read the Developer Guide.

---

🏗 System Architecture

NextPGP separates client-side cryptography from cloud storage via an authenticated zero-knowledge boundary:

flowchart TB
    subgraph Client["Client Browser (PWA)"]
        UI["HeroUI / React 19 Frontend<br/>(Main Thread)"]
        Pool["Dynamic Web Worker Pool<br/>(lib/workerPool.ts)"]
        Worker["Crypto Workers (Multi-core)<br/>(lib/cryptoWorker.ts)"]
        IDB[("Encrypted IndexedDB<br/>(lib/indexeddb.ts)")]
        VaultCtx["In-Memory Vault Context<br/>(Ephemeral Key State)"]
        
        UI <-->|"Jobs & Events"| Pool
        Pool <-->|"Parallel Tasks"| Worker
        UI <-->|"AES-256-GCM Wrapped Keys"| IDB
        UI <-->|"Session Unwrapping"| VaultCtx
    end

    subgraph Edge["Network Boundary (HTTPS Only)"]
        CSRF["CSRF & Timing-Safe Check"]
        RL["Redis Rate Limiter"]
    end

    subgraph Server["Next.js Cloud Backend"]
        NextAuth["NextAuth v5<br/>(Google, GitHub, Discord, Email)"]
        RouteAPI["Zero-Knowledge Route Handlers<br/>(/api/vault/*, /api/manage-keys/*)"]
        Prisma["Prisma ORM"]
        Postgres[("PostgreSQL Database<br/>(Encrypted Vaults & Keys)")]
        RedisStore[("Redis Store<br/>(Rate Limits & Tokens)")]
    end

    UI -->|"Opaque Authenticated Ciphertexts Only"| Edge
    Edge --> RouteAPI
    Edge --> NextAuth
    RouteAPI <--> RL
    RL <--> RedisStore
    RouteAPI <--> Prisma
    NextAuth <--> Prisma
    Prisma <--> Postgres

Loading

---

📖 Documentation Hub

Comprehensive architectural, cryptographic, and operational documentation is available in the docs/ directory:

Document	Purpose
Cryptographic Specification	Byte-level wire format, 45-byte NextPGP header, PBKDF2/AES-GCM key derivation, verification ciphers, and zero-knowledge proofs
System Architecture	Web Worker concurrency pool, client-side IndexedDB persistence, ephemeral memory lifecycle, and data models
Developer & Contribution Guide	Local environment setup, HTTPS certificates, Prisma migrations, running tests with Vitest, and ESLint
Self-Hosting Guide	Production deployment, Nginx reverse proxy configuration, OAuth provider setup (Google/GitHub/Discord), and full .env variable reference
Manual Test Matrix	Comprehensive test matrix for message, file, and folder encryption combinations

---

🧪 Testing & Scripts

# Run unit & integration tests with Vitest
pnpm test

# Run tests in interactive watch mode
pnpm test:watch

# Run linter checks
pnpm lint

# Build production bundle with Prisma migration deployment
pnpm build

# Launch Prisma Studio to inspect database records
pnpm prisma studio

---

🛠 Tech Stack

• Framework: Next.js 15 (App Router) & React 19
• Cryptography: OpenPGP.js & Native Web Crypto API
• UI Components & Styling: HeroUI & Tailwind CSS
• Database & ORM: PostgreSQL & Prisma ORM
• Authentication: NextAuth.js v5
• In-Memory Cache & Rate Limiter: Redis / ioredis
• Worker Multithreading: Custom Dynamic Web Worker Pool
• Testing: Vitest

---

💻 Video Previews

Keyring Management	Cloud Sync & Vault	Message & File Encryption

---

📸 Screenshots

💻 PC

📱 Mobile

---

📝 License

This project is licensed under the GNU General Public License v3.0.

---

💬 Contact & Support

• GitHub: @xbeast1
• Email: xbeast1@proton.me

✨ Next PGP simplifies secure messaging. Generate, manage, and encrypt with confidence! ✨