MailFlatDocs
HomeEmail testing APIOpen dashboard
Documentation/Guides/End-to-End Encryption

End-to-End Encryption

Zero-access privacy. Incoming mail is encrypted the moment it lands, and only a key on your device can read it. We store ciphertext we can't open.

How it works

Your passphrase never reaches us. We hold your public key and a copy of your private key that only your passphrase can unwrap.
• You pick a passphrase. Your browser generates an account key pair locally and wraps the private key with that passphrase.
• We only ever see two things: your public key, and the passphrase-wrapped private key (escrow). The unwrapped private key never leaves your device.
• Mail is encrypted on arrival with your public key. On our servers it's ciphertext, so we can't read it and neither can anyone who compromises the database.
• To read, your device unwraps the private key with your passphrase and decrypts locally.

Turn it on

  1. Enable it from your inbox
    Open the encryption toggle, choose Enable encryption, and set a passphrase of at least 8 characters.
  2. That's it
    Every new message is stored encrypted from now on. Mail that arrived before you enabled it stays as it was.
  3. Unlock on another device
    Open your inbox there and enter the same passphrase. The key is rebuilt in that browser from the escrow blob, and it is never sent to us in the clear.
Turning it off againDisable and re-enable keep the same key
Disabling stops new mail being encrypted; re-enabling resumes with the same key, so everything encrypted earlier stays readable. You are never forced to abandon old ciphertext to change your mind.
Under the hoodThe endpoints involved
POST /api/encryption/enable stores your public key and wrapped private key. GET /api/encryption/status returns the escrow blob so a new device can unlock. /disable and /reenable stop and resume encrypting new mail with the same key.

Things to know

Your passphrase is the only key
We cannot reset it and cannot recover encrypted mail if you forget it. That is what zero-access means. Store it somewhere you trust.
• Encryption is per-account: a single key pair protects all your inboxes; you can't swap keys without losing access to old ciphertext.
• Automation trade-off: when encryption is on, our servers can't read message bodies, so the otp_code field and API/agent reads come back empty/locked. For agent and CI workflows that need server-side OTP extraction, leave encryption off. It's built for human privacy, not automated pipelines.
• Lock this device. The decryption key is cached in each browser you unlock so mail opens instantly. On a shared or borrowed computer, use Address settings → Privacy → Lock this device to wipe that key from the current browser. Encryption stays on and new mail keeps arriving encrypted; just re-enter your passphrase to read here again. Signing out clears the key automatically.