Skip to content

PGP encryption

Add your PGP public key to an email recipient and every forward to it arrives encrypted, attachments included.

Any email recipient on an alias can carry a PGP public key. Once it's set, every message forwarded to that recipient is encrypted to your key before it leaves us, so the copy sitting in your mailbox is unreadable without your private key.

Turn it on

  1. Export your public key. With GnuPG: gpg --armor --export you@example.com > key.asc. Thunderbird, Proton, Mailvelope and most key managers have an "export public key" option that gives you the same -----BEGIN PGP PUBLIC KEY BLOCK----- text.
  2. Open the alias's manage page and find the recipient under Recipients.
  3. Click the key icon next to it, paste the key (or load the .asc file) and save.

The key icon turns solid when encryption is on. Open it again to see the key's fingerprint and expiry date, replace it, or remove it.

We check the key when you save it and refuse anything we couldn't encrypt to: a private key, a key without an encryption subkey, or one that's expired or revoked. Only the public key is stored.

What arrives

  • Subject: Fwd [PGP]: original subject. The subject line isn't encrypted.
  • Body: an ASCII-armored OpenPGP message containing the text version of the email. The HTML version is dropped so nothing leaks in clear alongside the ciphertext.
  • Attachments: each one arrives as its own encrypted file, named attachment-1.pgp, attachment-2.pgp, … so filenames don't leak either. The encrypted body lists which file is which, and the original filename is stored inside each encrypted file (gpg --use-embedded-filename -d attachment-1.pgp).

Thunderbird decrypts all of this natively; on the command line, gpg -d works on both the body and the attachments.

What it doesn't cover

  • The sender → us leg. The sender wrote plaintext and sent it to the alias. Only the sender can encrypt that part, by encrypting to your key before sending.
  • Telegram and webhook recipients. PGP is per email recipient. A Telegram chat or webhook on the same alias still gets readable copies.
  • Metadata. Sender, subject, and timing stay visible.

If your key expires

Forwards to a recipient whose key can no longer encrypt are not sent in clear; they fail instead. The key icon turns red on the manage page, and the dialog shows a warning 30 days before the expiry date. Extend the key's expiry (gpg --quick-set-expire) and paste the updated public key, or remove the key to go back to plain forwarding.