posted by VaelMail · 28 October 2026
Accessing Webmail over Tor (.onion) and I2P: The Zero-JavaScript Guide
How VaelMail's dedicated Tor onion service and I2P mirror provide sovereign, script-free webmail without client-side fingerprinting or tracking.
For individuals operating under elevated threat models—including investigative journalists, security researchers, whistleblowers, and privacy advocates—accessing email over standard clearnet connections presents fundamental surveillance risks.
Even when TLS encryption protects data in transit, network intermediaries (such as local ISPs, VPN providers, and state-level monitors) can observe DNS lookups, IP destinations, and packet timing metadata. Furthermore, modern complex webmail applications rely heavily on client-side JavaScript, which introduces browser fingerprinting vectors, canvas tracking, and potential cross-site execution vulnerabilities.
VaelMail resolves these issues by running dedicated hidden service mirrors across both the Tor network and the Invisible Internet Project (I2P), combined with a pure, script-free HTML interface that functions with JavaScript disabled completely.
The Risks of Client-Side JavaScript in Private Webmail
Most webmail providers require modern web browsers to execute megabytes of minified JavaScript before displaying a single email. While rich JavaScript frameworks enable interactive desktop interfaces, they also expose users to significant privacy trade-offs:
Browser fingerprinting: JavaScript APIs can query screen dimensions, system font lists, WebGL capabilities, audio context signatures, and battery state, constructing a unique identifier that tracks you across sessions.
Execution risks: If a malicious actor discovers a zero-day exploit in browser JIT (Just-In-Time) JavaScript compilers, visiting a script-enabled page can compromise the underlying operating system.
Memory leak vectors: Complex single-page applications run persistent long-polling background threads that can retain sensitive message bodies in browser memory indefinitely.
In Tor Browser's "Safest" security preset, JavaScript is disabled by default for all sites. Any webmail service that requires JavaScript simply fails to function in this environment.
VaelMail's Native Tor (.onion) and I2P Architecture
VaelMail provides first-class support for privacy networks through dedicated, isolated daemon processes running locally on sovereign infrastructure:
Tor Onion Service (v3): Accessible at
http://5gxnpixptykyv5fchr2qidjbrazjewswx77ddrqowpcmwmmgll57daid.onion. Traffic is routed through end-to-end encrypted Tor circuits, eliminating clearnet exit nodes and concealing both the user's physical IP address and the server's datacenter location.I2P GarliCat Mirror: Accessible at
http://zdqji3qs2j5gox4qslu5yakvpaiekzrvrrs7hqsjanescrdtgegq.b32.i2p. Uses packet-based garlic routing and unidirectional tunnels for resilience against traffic analysis.Clearnet No-JS Mirror: Accessible at
https://nojs.vaelmail.comfor users on lightweight browsers, older operating systems, or terminal-based text browsers (such as Lynx or w3m).
All hidden service traffic is processed by an isolated, non-JavaScript server process (vael-nojs) that emits pure, standard HTML and semantic form submissions.
Step-by-Step: Accessing VaelMail over Tor
Connecting to VaelMail anonymously through the Tor network requires only standard Tor Browser:
Download Tor Browser: Obtain official Tor Browser from torproject.org.
Set Security Level to Safest: Open Security Settings and select "Safest". This disables JavaScript across all sites and blocks HTML5 media codecs.
Open the Onion Address: Navigate to
http://5gxnpixptykyv5fchr2qidjbrazjewswx77ddrqowpcmwmmgll57daid.onion.Sign In with Your Account Key: Enter your VaelMail account number and cryptographic key. Because the form uses native HTTP POST handling, authentication completes immediately without executing client-side scripts.
Send and Receive Messages: Read your inbox, inspect incoming messages with external image loading stripped by default, and compose replies securely.
Privacy Defenses in the No-JS Interface
The script-free interface incorporates rigorous server-side privacy boundaries:
No external assets: Stylesheets and layout assets are bundled locally; zero external fonts or CDN dependencies are ever requested.
Automatic image neutralization: Remote tracking pixels and embedded web beacons are stripped server-side before rendering, preventing third parties from confirming when a message is opened.
Cookie isolation: Session cookies are scoped strictly to the onion or i2p host, preventing cross-domain session leaks.
Zero tracking headers: No Google Tag Manager, analytics beacons, or third-party telemetry scripts exist anywhere in the application.
Choosing Between Webmail and Onion Access
For daily casual communication on modern desktop computers, VaelMail's standard webmail client at vaelmail.com offers a convenient, retro desktop experience with window management and audio cues.
When operational security and maximum anonymity are required, use the Tor onion address (5gxnpixptykyv5fchr2qidjbrazjewswx77ddrqowpcmwmmgll57daid.onion) or the I2P mirror with JavaScript disabled.
Read our guides on what private email protects and paying for email with Monero for full details on our sovereign email infrastructure.
