An open-source (Apache-2.0) end-to-end email encryption proxy. It is a stream encryptor for RFC 5322 / MIME messages wrapped in transparent IMAP4rev1 and ESMTP proxy servers: your existing email client connects to the proxy instead of to your provider, outgoing mail is encrypted on the fly, incoming mail is decrypted on the fly, and your provider only ever stores ciphertext.

No. VESmail works with the IMAP account you already have. You keep your address, your history and your contacts.

Any standard IMAP/SMTP client — Thunderbird, Apple Mail, Outlook, K-9 and the like. Browser-based webmail viewers bypass IMAP and are the one exception.

An encrypted message with a plaintext banner part that explains how to read it; they can decrypt it after setting up a VES PIN, without a full VESmail setup. Alternatively, the sending profile can be set to FALLBACK mode, which sends unencrypted when any recipient is not on VES.

VES (vesvault.com) is the key management and recovery service that VESmail is built on, through the public VES APIs. Creating a VESmail account creates a VES account for the same email address; the same VES account also works with any other VES-integrated application.

Sign in to the Profile Manager with your email address. A new address receives a verification code by email, and you choose a VES PIN — there is no separate registration form. That creates your VES account; your VESmail profile is then created on the same page. Create the account before first using the vesmail CLI or a proxy — the CLI will stop with VES account is not set up otherwise.

It is stored in your VESmail profile — an end-to-end encrypted object in the VES repository that only your own VES keychain can decrypt. The VESmail instance you use decrypts it to log in to your provider on your behalf. VES itself cannot read it.

No. VES stores wrapped (encrypted) message keys and your encrypted profile; message content never passes through VES. Encryption and decryption happen on the VESmail instance.

A VESmail instance needs connectivity to the VES API to unlock keys, so you cannot encrypt or decrypt while it is down. VESmail is an online-first design; your mail remains safely stored (encrypted) on your provider's servers in the meantime, and any non-VESmail mail is unaffected.

A PIN is required to create the VES account that a VESmail account is linked to. After setup it is not used in day-to-day operation, but you need it to unlock the VES keystore on a new device and to assist friends in VESrecovery — so don't discard it.

VESrecovery™ rebuilds a lost keychain through a network of friends, without any shared master key and without any single party being able to access your content. Set up your recovery network before you need it. See VESvault.com and The Math for how it works and the failure odds.

Anywhere: your own machine, a home server, a company server or a cloud host. When the instance runs on hardware under your control, encryption and decryption happen entirely on your side — end-to-end encryption in the strict sense. A hosted instance is also available for evaluation; the code and the encrypted-at-rest result are the same, you just trust the operator instead of running your own.

Username = your email address (optionally with a profile suffix); password = your VES App Key for VESmail. Keep the App Key secret; if it leaks, rekey the vault at vesvault.com.

SNIF (snif.host) gives an instance without a public IP or domain a unique hostname with a publicly trusted, end-to-end TLS certificate — the private key never leaves the instance, and the relay sees only TLS ciphertext. The SNIF connector is built into VESmail, and SNIF is open source.

In the Profile Manager. Enter your provider settings and credentials there, and supply your instance's URL to verify them through your own instance — credentials are never verified through anyone else's. Without an instance URL the profile can still be saved, just unverified. Profiles can also be created and managed from the command line — see profile-cli.

The README covers building, the CLI, proxy configuration, authentication and daemon setup, with sample configs in the repository. The encrypted email format is specified in ves-mime.