posted by VaelMail · 15 November 2026
End-to-End Encrypted Email: What It Is and What It Isn't
End-to-end encryption means only the sender and recipient can read a message. Why most email is not end-to-end, what is, and how VaelMail's options differ.
"Encrypted email" is used for several different things, and the difference matters. This guide explains end-to-end encryption, why ordinary email cannot be end-to-end between providers, and which layers of protection VaelMail offers, with their limits.
What end-to-end encryption means
In end-to-end encryption a message is encrypted on the sender's device and can only be decrypted on the recipient's device. Nobody in between, including the mail provider, can read it. The keys live with the two people, not with the service.
Why ordinary email is not end-to-end
Email was built to move readable messages between servers. When you send to someone at another provider, your mail server hands the message to theirs, and both servers handle it in a form they can read. Transport encryption (TLS) protects the message between servers when both support it, but each server still sees the content. That is why "encrypted email" on its own does not mean the provider cannot read your mail.
The layers that do exist
Encryption on disk and in backups protects stored mail if a disk or a backup is taken. The running server can still read mail it is serving.
Mailbox encryption seals stored mail with a key the user holds. The server cannot read the sealed mail at rest, but mail from other providers arrives readable first.
Message encryption such as OpenPGP encrypts the body so only the recipient's key can open it. This is end-to-end, but only when both people use it.
How VaelMail's encrypted mailbox works
VaelMail's encrypted mailbox is optional and free. When you turn it on, your stored mail and the search index are encrypted with a mailbox key that VaelMail does not store. If you lose the key, the sealed mail is gone, because VaelMail cannot recover it.
It has limits that you should know before you rely on it:
Mail from other providers reaches the server as it arrives, before it can be sealed.
While you are signed in and unlocked, the server decrypts mail in memory to show it to you.
Some metadata such as dates, sizes, folders and addresses stays visible to the server.
Backups made before you turned it on keep the readable copy until they expire.
So it is not zero-knowledge, and VaelMail does not describe it that way.
Where OpenPGP fits
OpenPGP in the browser is the end-to-end option. Messages are encrypted and decrypted on your device, and the server handles ciphertext. It only protects a conversation when the other person uses OpenPGP too, and it protects the body, not the addresses.
Which layer do you need?
If you worry about stored mail being read from a disk or backup, the encrypted mailbox helps.
If you worry about the provider or anyone in the middle reading a conversation, use OpenPGP with people who also use it.
If you need a provider that encrypts mail zero-access by default for everyone, look at the providers compared in VaelMail vs Proton Mail and VaelMail vs Tuta. They do that, and VaelMail does not.
For the whole model in one place, read the security page.
