the answer is probably using RSA to encrypt private messages. Each user has a keypair, and Alice uses Bob's public key to encrypt her message, and Bob decrypts it with his private key. The issue comes with the distribution and security of these keypairs
Since the only information known only to a user within a system like this is a password, it will be difficult to effectively and securely store the user's private key. The only mechanism I can think of is encrypting the private key with a key derived from the user's password. This private key is then stored, probably client-side, and used to encrypt and decrypt messages while the user is logged in.
Unfortunately, this system puts you at the mercy of security issues of whatever technology you choose to use (cookies, server-side session data, localStorage, etc), and a motivated attacker can probably circumvent it fairly easily. It would probably necessitate some sort of browser plugin to provide a brigde to gpg or equivalent to come even close to being secure, and that will end up being more trouble then it's worth.
Long story short: You probably can't do it in a way that is actually secure against a motivated attacker