The people disabling javascript are also probably aware that javascript crypto is utterly pointless with the current browser security model. Javascript crypto aims to protect you from the server, but you must rely on the server sending javascript that actually does the encryption. When it can&#x27;t protect you against the adversary it&#x27;s design to protect you against then what is the point?<p>Imagine a client-side-encrypted version of google docs that always encrypts your document before sending it back to the google servers. Any time you visit the site google could send you a modified version of the site javascript (possibly at the request of security services) that just uploads the document without encrypting it first. Browsers currently have no way to prevent that or even notifying you that it&#x27;s happening.<p>If you want to do client side crypto you need to do it in native apps. The web is just too technically limited to support building platforms on top of it that have different trust models.