w3myPQ standalone HTML/JS excerpt

post-quantum encryption decryption tool

the w3myPQ WordPress plugin use cross-compatible file format

ML-KEM + AES-GCM + ML-DSA

Securing the present and the future of your secrets

Check out the online example—safe to use from anywhere

Online exec BennyPQ

BennyPQ post-quantum HTML file

Download BennyPQ

BPQ on Github

WHAT IT IS

BennyPQ is a zero-trust, post-quantum cryptography tool using Noble and the w3Gemini Engine written in JS/HTML.

True cryptographic sovereignty shouldn’t require installation, servers, or complex software chains.

BennyPQ is a high-performance, single-file browser utility designed for absolute privacy and cryptographic resilience. By packing NIST-standard post-quantum algorithms —ML-KEM 1024 and ML-DSA 87—alongside symmetric AES-GCM encryption into a single, self-contained HTML/JS file, BennyPQ lets anyone secure files and data anywhere, completely offline. Just load the html file into your Browser.

Note: The BPQ tool and the w3myPQ plugin for WordPress use cross-compatible file format.

Core Pillars & Cryptographic Architecture

• NIST ML-KEM (FIPS 203): Provides future-proof, quantum-resistant Key Encapsulation Mechanisms to protect encrypted data against “harvest now, decrypt later” attacks.
• NIST ML-DSA (FIPS 204): Delivers robust, post-quantum digital signatures for unforgeable file authenticity, integrity, and non-repudiation.
• AES-GCM Envelope Encryption: Combines high-speed symmetric encryption for the raw data payload with asymmetric post-quantum key transport.
• Zero-Knowledge & Air-Gapped Ready: All encryption, decryption, and key generation happen entirely client-side inside your browser. No data ever leaves your machine, and the tool functions seamlessly without an active internet connection.
• 🪺 Cincia Keys Vault: Advanced Key Obfuscation (Nest Technology)
• Unlike traditional key managers that simply encrypt keys into standard formats, BennyPQ v2.0.0 introduces a radical Zero-Knowledge Obfuscation System known as the Cincia Keys Vault.

Maximum Privacy Through Absolute Browser Independence

BennyPQ use the Noble post quantum lib for the ML-KEM and ML-DSA encryption/decryption math.

Unlike traditional software architectures that rely on complex backend infrastructure, cloud intermediaries, or opaque third-party services/software, BennyPQ achieves maximum privacy and security by depending solely on the browser itself:

• Zero Backend Attack Surface: With no databases to leak, no server misconfigurations, and no API middleware logging traffic, your data is completely immune to remote server compromises.
• Complete Cryptographic Sovereignty: Your device holds the keys, executes the pure mathematics locally, and handles decryption right in front of you within a sandboxed environment.
• Total Source Transparency & Verifiability: Because the entire utility lives in a single, clean file, you never have to blindly trust a remote server’s promise of privacy. You can audit every line of code yourself, disconnect your network cable, and run it securely completely offline.

Designed for the Real World

• Absolute Portability: No npm modules, no build steps, and no external CDNs. It is a single file that you can save to a thumb drive, drop into a browser tab, or run on an air-gapped machine.
• Seamless Ecosystem Compatibility (w3mypq Integration): Built to be fully interoperable with the w3mypq WordPress plugin ecosystem. Prototype, test, and package encrypted payloads locally using BennyPQ, then handle them securely in production via your WordPress infrastructure. Last part of this is coming soon.
• Embedded Web Worker Architecture: Heavy cryptographic computations are offloaded to an embedded, blob-backed Web Worker to ensure the user interface stays responsive even when handling large files.

Use Cases

• Secure File Exchange: Safely transfer sensitive documents across untrusted communication channels.
• Offline Data Vaults: For anyone needing guaranteed, long-term data privacy.

Note that…

** If you are a Windows OS user or Android or iOS (?) and you think that their encryption or decryption programs that you may use to encrypt files or Apps to send messages sets you secret and safe. If you think that there is another way than this to be secret, and you are not a security expert and a very advanced developer that coded all the necessaries routines from scratch without errors you are (probably) wrong.

And remember: it’s easy for someone at several network levels to sniff your data. And to decrypt your data. And for an analyst who picks up your device.

–Do not give them a chance.

HOW TO USE (no sign)

Example A:
User A wants to send secrets files or typed secret text to User B.
– B sends his generated ML-KEM Public Key to A, which A uses to encrypt the files or messages.
– A sends the encrypted files to B. These can only be decrypted by B, who is the sole owner of the ML-KEM Private Key.

Example B:
You wants to store secrets files into your hard drive.
– Encrypt using your generated ML-KEM Public Key. Optionally Sign the file loading your ML-DSA Private key.
– Decrypt using the ML-KEM Private Key and (optionally) the ML-DSA Public key if you want to check the authenticity of the file being decrypted.

Sign files:

The BennyPQ ML-DSA Signing & Verification Workflow

1. Key Generation (User A):
   • User A opens BennyPQ locally in their browser and generates an ML-DSA Keypair.
   • This yields two components:
     • Secret/Private Key: Stored securely. This is never shared.
     • Public Key: Shared with User B or published so anyone can verify User A‘s files authenticity.
2. Signing the File (User A):User A applies their Private ML-DSA Key to sign the file’s binary content.
   • User A send the file (and the Public ML-DSA key if not already sent) to User B.
3. Verification & Integrity Check (User B):
   • User B receives the file and having the signature (maybe B will store it so user A will not have to send it out each time).
   • User B loads their ML-KEM Private key, the User A Public ML-DSA Key and the file to be decrypted into BennyPQ.
   • The tool runs the verification algorithm locally:
     • If the file is untampered and authentic: the tool confirms the signature is valid, proving beyond a doubt that the file came from User A and has not been altered by a single bit.

Substantially resuming a use case where Bob wants to send to Alice and viceversa:

Bob create his own ML-KEM and ML-DSA key pairs.

Alice do the same.

Bob safely store his ML-KEM and ML-DSA Private keys, and share his ML-KEM Public and ML-DSA Public keys with Alice. Alice do the same with Bob sending their own Public keys.

Now suppose Bob wants to send files to Alice and Bob and Alice wants to be sure that their files are safe when transferred along the www. Not only that files cannot be viewed by anyone because only Alice own the ML-KEM Private key, but also that the file is authentic (really coming from Bob).

Bob open the Encrypt screen and load the Alice ML-KEM Public key.

Then (optionally) load his (Bob) Private ML-DSA key.

Bob encrypt the files and send the resulting encrypted and downloaded file to Alice.

Alice receives the encrypted file, opens the BennyPQ Decrypt screen, loads her ML-KEM Private key, and decrypts it. Without loading Bob’s Public ML-DSA key into the decryption screen, the result will be marked as ‘SENDER NOT VERIFIED‘. If Alice wants to be sure that the file she received was sent by Bob, she will have to load Bob’s ML-DSA Public key and decrypt it to verify the file’s authenticity. If the signatures match, the result will be marked as ‘VERIFIED‘.

Security

Share your ML-KEM (or ML-DSA) Public Key with anyone you wish to receive secure messages from; they will use ML-KEM to encrypt files that only you can decrypt.

Note that securely storing your Private Key files is entirely your responsibility. If an attacker discovers your Private Key(s), the security of your files and messages will obviously be compromised. Additionally, keep in mind that attackers at various network levels can easily sniff or intercept your data—and if they obtain your key, decrypt it as well.

Since V2.0.0: Cincia Keys Vault to secure Private keys on the device.

📝 Maximum Local Security

To make sure your files remain absolutely un-cracking while sitting on your filesystem, keep these rules in mind:

• Always use a long passphrase: The 700000-loop slowdown relies heavily on entropy. A phrase with 5-6 random words Upper and lower case makes your local file mathematically irreversible.
• Use the Firefox browser in Private mode.

---

When you use Firefox in Private Browsing mode, the browser does not save your browsing history, cookies, search history, or temporary cached files to your disk.

Here is exactly how it handles memory and data:

• Volatile Memory (RAM): While the private window is open, it keeps active session data (like temporary cookies and cache) in your computer’s short-term memory (RAM).
• Automatic Cleanup: As soon as you close all private windows, Firefox immediately wipes this data from the RAM and completely cleans up the session.

Do not take everything for granted. Read the ‘Tips for staying super secret’ section on bottom of the Gemini w3mypgp dedicated page before assuming you are safe and secret:

USE FIREFOX 🦊