[brute]

This is a browser addon, right? Is everything loaded locally? If no, what prevents you from putting up some javascript that transfers the decryption password (or the plain text) to you.

Sorry, didn't bother to download and look for the source code, to find out how the inner mechanics work. The website doesn't give much information either.

[tptacek]

No, it doesn't appear to be. They're at pains to say "nothing is installed", and when I created an account, it loaded "openpgp.min.js" from the server.