Methmail is still being built. This page describes how its protection will work and, separately, lists what that protection won’t be able to do. It will be updated as we go; the date of the last change is at the bottom.
In short
Emails between Methmail users will be end-to-end encrypted: only the sender and the recipients will be able to read them. Stored emails, whether from Methmail users or from other providers, will be encrypted with keys we don’t have. Emails from other providers will be encrypted the moment they arrive, before they are written to disk.
At that moment the message will pass through our server unencrypted: that is how regular email works. Mail to another provider without PGP will wait in the send queue until delivery (up to 48 hours), on a volume encrypted with our key. More on this under What Methmail won’t be able to do.
What your keys will encrypt
- message text and attachments;
- subject lines;
- senders and recipients of stored messages;
- drafts;
- contacts, every field;
- folder and label names;
- filters (except server-side rules you turn on yourself) and signatures.
The search index will be built on your devices. If a copy of it is ever sent to our servers, it will be sent only encrypted with your keys.
Ads, AI and spam filters
Methmail will have no ads. We won’t analyze the content of your email for ads or for AI training.
Emails from other providers as they arrive, and your emails to other providers sent without PGP as they leave, will be checked by automated spam, malware and threat filters. The filters will keep none of the content: only the verdict, spam or not, will be kept.
Cryptography
OpenPGP compatibility. Methmail will be OpenPGP-compatible: you will be able to exchange encrypted email with PGP users, add your contacts’ public keys and export your own keys in OpenPGP format. Not every PGP program supports post-quantum keys yet; for those recipients Methmail will use a compatible format and tell you so.
Post-quantum protection. Emails between Methmail users and all stored mail will be protected with hybrid post-quantum encryption (ML-KEM-768 plus X25519), on by default from day one. Decrypting a message would require breaking both algorithms. An external PGP recipient will get a post-quantum message only if their key supports RFC 9980. For external mail without PGP, protection in transit will depend on the recipient server’s TLS. A message from an external PGP sender without post-quantum protection will get it when Methmail first syncs it in your browser; until then it will be protected classically. The limits of post-quantum protection are under What Methmail won’t be able to do.
Sign-in and account recovery
Sign-in. You will be able to protect sign-in with passkeys and hardware security keys (FIDO2/WebAuthn) or an authenticator app. We won’t use SMS as a second factor. Your password will never reach our servers, not even when you sign in. You will also be able to sign in with a passkey and no password, if your device supports passkeys with the PRF extension; otherwise a passkey will work as a second factor. A passkey added after sign-up won’t unlock your mailbox without a password at once: after 72 hours if you have a device you signed in on more than a week ago, and after 7 days otherwise. This protects you from account takeover. For the web app, see What Methmail won’t be able to do.
Recovery. If you forget your password, your recovery phrase, a signed-in device or a passkey with account recovery turned on will get you back in at once, old emails included. If all you have left is a recovery email, you will get your address back after 7 days (after 72 hours if one of your devices has been signed in for more than a week), but old emails will stay locked: we won’t have the keys. If you lose everything, nobody will be able to open the old emails in your mailbox, including us.
Recovery email. A recovery email will be optional. If you add one, we will store only its hash: to reset your password, you will type the address yourself. We won’t be able to hand over your recovery address, only confirm or deny someone else’s guess. When you add a recovery address and when you reset your password, our server will see it, to compute the hash and to send the link. On a reset, that address’s mail provider will see an email from Methmail, but not your Methmail address. A court will be able to order us to record the address at one of those moments (exceptions).
Export and deleted addresses
You will be able to export your emails in standard formats (EML and MBOX) and your keys in OpenPGP format.
Nobody will be able to take a deleted address on a Methmail domain again, not even you. Otherwise its new owner would get someone else’s email, including password resets from other services.
Access over Tor
By launch, the Methmail web app will be available over Tor, in Tor Browser on desktop at the Standard security level. At Safer and Safest, Tor Browser turns off WebAssembly, which the web app’s encryption runs on, so the web app won’t open there. Tor hides your IP address even from us. We will publish the Tor address here once it works.
What Methmail won't be able to do
Many of these limits apply to any end-to-end encrypted email that works with regular email. We are stating them up front.
- Mail from other providers. It arrives over standard email (SMTP) unencrypted. Our server will see such a message as it arrives, encrypt it immediately and not keep it unencrypted.
- Mail to other providers. Email sent to another provider without PGP will leave unencrypted, so the recipient’s provider will be able to read it. That provider always sees the subject and the addresses.
- Metadata. We will see and store some metadata. It is listed in the inventory, whose first rows are already published: Privacy.
- Webmail. The Methmail web app will load its code from our servers every time you sign in. So it will be impossible to fully rule out a modified version being served to one person, if our servers are hacked or we are forced to do it. Methmail won’t have apps at launch: if you face someone who could make us do this, take this risk into account.
- Losing access. If you lose your password and every recovery method, nobody will be able to open the old emails in your mailbox, including us.
- Your device and your recipient. Encryption does not protect against malware on your device or against a recipient who forwards your email.
- Court orders. A court or authority in the USA, where the company is registered, in the country where our servers are, or where members of our team live, will be able to order us to start recording the IP addresses of a specific account, to keep its future incoming emails from other providers before they are encrypted, and to copy its future emails to other providers sent without PGP. What we won’t keep can’t be obtained retroactively. We will be able to hand over what we keep in readable form (listed in the inventory) and what hasn’t been deleted yet: mail to other providers without PGP still in the send queue (up to 48 hours) and technical logs within their retention periods (also in the inventory). We won’t be able to hand over stored emails or keys: we won’t have them in readable form. There is protection: Tor hides your IP even from us, and we won’t be able to read emails the sender encrypted to the recipient’s real key (PGP or Methmail), even as they arrive.
- Signatures and sign-in checks. Post-quantum protection will cover encryption. Signatures and sign-in checks will stay classical for now: they confirm authorship and access and reveal no content. We will move to post-quantum signatures once major PGP programs support the standard.
- Swapped keys. Methmail will check your contacts’ keys against a public key log: a swapped key can be detected but not ruled out in advance. External PGP programs don’t check the log: for them, a key they get from us will be a matter of trusting us.
How you will be able to check
Every six months we will publish a transparency report: how many requests we received from authorities, how many we complied with, and what we handed over.
We will open the source code of the Methmail web app before the closed beta. The server code stays closed for now. End-to-end encryption will run in your browser, and you will be able to check it in the open code. Mail from other providers will be encrypted by our server as it arrives, and that part can’t be checked in the open code.
The Methmail web app will load its code from our servers every time you sign in. So it will be impossible to fully rule out a modified version being served to one person, if our servers are hacked or we are forced to do it. Methmail won’t have apps at launch: if you face someone who could make us do this, take this risk into account.
The web app’s build will be reproducible: anyone will be able to build it from the published code and compare it with the files our servers deliver. A check will show what our servers delivered to you at the time you checked. The browser itself doesn’t check anything, so a check won’t be able to stop our servers from delivering you a modified version: a swap can only be noticed.
There has been no independent audit yet.
Report a vulnerability
We will open vulnerability reporting together with email.