Feature
Email over Tor and I2P, without JavaScript
VaelMail runs a script-free site on the regular web, on a Tor onion address and on an I2P address. They serve plain HTML so you can read, send and manage mail with JavaScript turned off.
The addresses
| Network | Address |
|---|---|
| Regular web, no JavaScript | nojs.vaelmail.com |
| Tor (.onion) | 5gxnpixptykyv5fchr2qidjbrazjewswx77ddrqowpcmwmmgll57daid.onion |
| I2P (.b32.i2p) | zdqji3qs2j5gox4qslu5yakvpaiekzrvrrs7hqsjanescrdtgegq.b32.i2p |
Why a script-free site
JavaScript in a browser widens the attack surface and can leak details about your device. The mirrors serve plain HTML and CSS only, so they work in Tor Browser at its safest setting, in text browsers and with scripts blocked.
What is different there
- No rich-text compose, rule editor or interactive previews.
- Registration uses an image challenge instead of the in-browser proof-of-work check.
- A passkey-only account cannot sign in on the script-free mirrors. Authenticator codes and recovery codes work.
- OpenPGP cannot run in the browser without scripts, so the server decrypts for a single page view, clearly labelled. See OpenPGP.
What using Tor does and does not do
Reaching VaelMail over Tor hides your IP address from VaelMail and your network from the server. It does not hide what you write, and the mail you send still travels through ordinary email servers. See the security model.
Common questions
Is the Tor mirror the same account?
Yes. You sign in with the same 16-digit account number and see the same mailbox.
Does the regular site work without JavaScript?
The public pages are readable without it. To use your account without JavaScript, use the script-free site.