You type your message in a special window/box, controlled by the plugin so the webmail can't read it. In fact, Mailvelope was audited to check that malicious ja

You type your message in a special window/box, controlled by the plugin so the webmail can't read it. In fact, Mailvelope was audited to check that malicious javascript in the server can't read your plaintext.