Feature
The encrypted mailbox
Turn it on and VaelMail seals your stored mail and your search index with a mailbox key that only you hold. VaelMail cannot recover the key, so it also cannot read the sealed mail at rest. It is optional, free, and it is not zero-knowledge: read the limits below.
What it does
When you turn on the encrypted mailbox under Security, VaelMail shows you a mailbox key once and asks you to confirm that you saved it. From then on your stored mail and the search index are encrypted with that key. VaelMail does not store the key.
Turning it on also creates your OpenPGP key pair. It works on the regular site, the no-JavaScript site, Tor and I2P.
What it does not do
- Mail from other providers still reaches the server as it arrives, before it can be sealed.
- While you are signed in and unlocked, the server decrypts mail in memory to show it to you.
- Some metadata stays visible to the server, such as dates, sizes, folders and delivery addresses.
- Backups made before you turned it on keep the readable copy until they expire.
What changes while it is on
| Feature | With the encrypted mailbox on |
|---|---|
| Lost key | The sealed mail is gone. VaelMail cannot help. |
| Moving mail | Needs the mailbox unlocked. |
| Snooze | Unavailable. |
| Mail apps using app passwords | Cannot read your mail. |
| Turning it off | Needs your account number, second factor, mailbox key and a typed confirmation, and sends you an alert. Your OpenPGP key pair is deleted, so export it first. |
Who should turn it on
Turn it on if the risk you care about is someone reading stored mail from a disk, a backup or a database. Leave it off if you use a desktop mail app over IMAP, rely on snooze, or cannot guarantee you will keep the key. For messages the server should never see in readable form, use OpenPGP with someone who also uses it.
Common questions
Is the encrypted mailbox end-to-end encryption?
No. End-to-end means only the sender and recipient can read the message. Ordinary email between providers cannot be end-to-end encrypted. The encrypted mailbox protects mail at rest, and OpenPGP is the end-to-end option.
Does it cost extra?
No. It is free on every account.
Can I turn it off?
Yes. You confirm with your account number, second factor, mailbox key and a typed confirmation, and VaelMail stores your mail readable again.
What if I forget the mailbox key?
The mail sealed with it cannot be read by anyone, including VaelMail. Save the key in a password manager when it is shown.
Keep reading
Ready to try it?
Create an account, then turn on the encrypted mailbox under Security if you want it.