It actually started out as a web app, but the web as a platform is unfortunately not at the point that it can be relied on for zero-knowledge encryption. In sh

It actually started out as a web app, but the web as a platform is unfortunately not at the point that it can be relied on for zero-knowledge encryption. In short, the goal is to not have to trust the server, but if the server is delivering you javascript and html, there's no way to avoid trusting it. Browser extensions are another problem--there's no way to block a browser extension that has been given page-level permissions from reading the DOM, so managing secrets in your browser means implicitly giving access to a lot of different third parties if you use extensions.