The private inbox

Off by default. When you turn it on, messages stored for your inbox-only aliases are encrypted so that we cannot read them, even though they are sitting in our database.

How

Your browser generates a key pair. The public half comes to us; the private half is encrypted in your browser and stored in that form, so what we hold is useless without your unlock.

When mail arrives we generate a random content key, encrypt the message with it, and encrypt that key to your public key. Sealing needs only the public half, so it works with nobody logged in.

Reading unlocks the private key in your browser and decrypts locally. The plaintext never comes back to us.

What it costs

Lose the key and the mail is gone. Same shape as the account number, and just as final.

No server-side search. We cannot index what we cannot read. Search over sealed messages happens in your browser, over what it has decrypted.

Nothing else changes. Forwarding is untouched, because forwarded mail is never stored in the first place.

The limit worth being honest about

This protects stored mail. It does not protect mail in transit through us, because there is no such thing as forwarding mail you cannot read.

If you use a forwarding alias, your mail passes through our servers in plaintext. It is not stored, but it exists here for the moment it takes to send it on, and we could in principle be compelled to capture it going forward. The private inbox does not change that; only using inbox-only aliases does.

There is also a limit that applies to every service of this kind, including the ones that make more noise about it than we do: we serve the JavaScript that does the encryption. A compromised or compelled server could ship a build that leaks your key, and you could not tell from inside the browser. Nobody in this industry has solved that. What narrows it is reproducible builds and published hashes, so you can check that what we serve matches the source. That is on our list and it is not done yet.

We would rather tell you that than let you assume otherwise.

Something here wrong or missing? Tell us. These pages live in the same repository as the code, so a correction is a one-line change.