posted by VaelMail · 15 November 2026
How to Send OpenPGP-Encrypted Email From Your Browser
Turn on the encrypted mailbox to get an OpenPGP key, find or add a recipient's public key, and send an end-to-end encrypted message from VaelMail.
OpenPGP lets two people exchange messages that only they can read, even though the mail passes through servers. VaelMail builds it into the webmail so you do not need extra software. This guide shows how to get set up and what to check.
What you need
A VaelMail account with the encrypted mailbox turned on. Your OpenPGP key pair is created in your browser when you turn it on.
The recipient's public key, or a recipient whose key VaelMail can find.
A recipient who can decrypt OpenPGP, for example with a mail app or a tool such as GnuPG.
Step 1: get your key
Sign in on the regular site and open Security.
Turn on the encrypted mailbox. VaelMail shows you a mailbox key once. Save it and confirm.
Your OpenPGP key pair is generated in your browser. The secret half is stored locked with your mailbox key. Your public key is published for your main address so others can find it. Aliases are never linked to a key.
Step 2: export a copy of your private key
Export your private key and keep a copy somewhere safe, such as your password manager. Turning the encrypted mailbox off deletes the key pair on the server, so export it first if you want to keep it.
Step 3: find the recipient's key
VaelMail looks up the public key for a recipient from your saved contacts, then its own directory, then the web key directory of the recipient's domain. If you already have the key as a file, add it to your contacts yourself. Check the fingerprint with the recipient through another channel before you trust it.
Step 4: write and send
Write the message as usual and choose to encrypt it. The body is encrypted on your device with the recipient's public key before it leaves, so VaelMail only sees ciphertext. Sending requires Plus.
Step 5: read an encrypted message
When someone sends you an OpenPGP message, it is decrypted on your device in the regular site. If you are on the script-free site, the server decrypts for a single page view and labels it clearly. The offline decryption tool is a single file that makes no network requests, for when you want to decrypt away from the site.
What OpenPGP does not hide
OpenPGP protects the message body. The sender, the recipient addresses and the delivery details of ordinary email stay visible to the servers that carry it. For that reason it is best used for content you would not want read, not for hiding that you wrote to someone.
Common problems
The recipient does not have a key: send a normal message first and ask them to share their public key.
You cannot decrypt an old OpenPGP message in webmail after turning the mailbox off, because the key pair was deleted from the server. If you exported your private key, decrypt it with the offline tool or GnuPG.
A mail app cannot read your mail: while the encrypted mailbox is on, apps that use app passwords cannot read it.
See the OpenPGP feature page for the short version, and what end-to-end encryption means for the background.
