Usually, when you sign in, your password goes to the server, which compares it with its own record. Ours will work differently: here is how, what it gives you, and what it will cost us.
What we decided
Your password will never reach our servers, not even when you sign in. Your device and the server will exchange a few messages that show the server the password is correct without containing it (the OPAQUE protocol, RFC 9807). One caveat: the web app will load its code from our servers every time you sign in.
One password will both let you into your account and unlock your keys: there won’t be a separate mailbox password.
What a leak of our database would give
If our database is stolen, it can’t be used to guess passwords: that takes a separate secret key, and the key isn’t in the database. Someone who takes over a running server together with that key can guess passwords, though slowly: every attempt is expensive. A short or already-leaked password won’t hold.
The quantum question
You’ll only be able to sign in over a connection with post-quantum protection (a hybrid of X25519 and ML-KEM-768). That way, a sign-in someone records today won’t help them guess your password even once quantum computers arrive. The sign-in check itself is still classical, but it runs inside that channel. A browser without this protection won’t be able to sign in and will need an update.
What it costs
- A forgotten password. If you forget your password, your recovery phrase, a signed-in device or a passkey with account recovery turned on will get you back in at once, old emails included. If all you have left is a recovery email, you will get your address back after 7 days (after 72 hours if one of your devices has been signed in for more than a week), but old emails will stay locked: we won’t have the keys. If you lose your password and every recovery method, nobody will be able to open the old emails in your mailbox, including us.
- A weak password. Since one password opens both your account and your keys, a weak password weakens both. Your password will be checked against breach lists on your device, or by a request to us that isn’t tied to your account: it carries only the start of the password’s hash, shared by many passwords. Third-party services will get neither your password nor its hash. How to pick a strong one is in How to protect your email from hacking.
What this doesn't change
- The web app. The Methmail web app will load its code from our servers every time you sign in. So it will be impossible to fully rule out a modified version being served to one person, if our servers are hacked or we are forced to do it. Methmail won’t have apps at launch: if you face someone who could make us do this, take this risk into account.
- Your device. Encryption does not protect against malware on your device or against a recipient who forwards your email.
- A fake site. A password typed into a fake page leaks either way, so change it. A passkey will protect you from a fake site: it’s tied to our address and won’t work on someone else’s page. A code from an authenticator app doesn’t protect you like that: it can be typed into a fake page too. A passkey protects the sign-in, not the password. How to tell a fake is in How to spot a phishing email.
- Signatures and sign-in checks. Post-quantum protection will cover encryption. Signatures and sign-in checks will stay classical for now: they confirm authorship and access and reveal no content.
The other limits are listed under What Methmail won’t be able to do.
What’s next
You will be able to sign in with a passkey and no password, if your device supports passkeys with the PRF extension; otherwise a passkey will work as a second factor. A passkey added after sign-up won’t unlock your mailbox without a password at once: after 72 hours if you have a device you signed in on more than a week ago, and after 7 days otherwise. This protects you from account takeover.
The whole picture is on How protection will work.