Feature
OpenPGP in your browser
VaelMail encrypts and decrypts OpenPGP messages in your browser, so the server only handles ciphertext. It is end-to-end only when the person you write to also uses OpenPGP.
How it works
Your OpenPGP key pair is created in your browser when you turn on the encrypted mailbox, and its secret half is stored locked with your mailbox key. On the regular site, encrypting and decrypting messages happens on your device.
Your public key is published for your main address so other people and their mail apps can find it. Aliases are never linked to a key. To write to someone else, VaelMail looks up their public key or you can add it yourself.
You can export your private key and keep a copy elsewhere. Do this before turning the encrypted mailbox off, because turning it off deletes the key pair on the server.
Offline decryption
The offline decryption tool is a single file you download and open locally. It makes no network requests, so you can decrypt a message without VaelMail being reachable.
On the no-JavaScript site
The script-free site cannot decrypt in your browser. There the server decrypts for a single page view and labels it clearly, or you can paste text you encrypted yourself. If that trade is not acceptable, use the regular site or the offline tool.
What OpenPGP does not protect
- It protects the message body. Addresses and delivery details of ordinary email are still visible to the servers that carry it.
- It only works end to end if the other person uses OpenPGP too.
- It is separate from the encrypted mailbox, which protects stored mail at rest.
Common questions
Do I need to install anything?
No. OpenPGP runs in the browser on the regular site.
How do I get an OpenPGP key?
Turn on the encrypted mailbox under Security. Your key pair is generated in your browser at that moment, and the secret half is stored locked with your mailbox key.
What happens to my key if I turn the encrypted mailbox off?
The key pair is deleted on the server and the published public key is removed. VaelMail offers to export your private key first.
Does OpenPGP work with aliases?
No. Aliases are receive-only and are never linked to a public key.