inboxhub

Private beta · zero-knowledge

Zero-knowledge webmail for the IMAP mailboxes you already have.

The whole mail client runs in your browser and talks to your IMAP and SMTP servers over TLS that ends on your device. Our servers only pass the encrypted traffic along and store data encrypted with keys they never have.

Works with any standard IMAP/SMTP provider. Gmail and Outlook are not supported.

  • Zero-knowledge
  • TLS in your browser
  • Encrypted vault
  • Bring your own AI key
Read the architecture Public launch coming soon
All inboxes 4
Starred
Mailboxes
Work
Personal
Company
  • Sarah MitchellContract draft for review
  • AccountingInvoice No. 2026-118
  • Emma ClarkeWeekend plans
  • Daniel WeberMeeting on Thursday at 14:00
  • Power companyYour October bill

AI, on your terms

Ask your mail. With your own model, or one on your machine.

Connect your own API key for Anthropic Claude or any OpenAI-compatible API, or run a model on your own computer, and ask across every mailbox at once: “Which invoices came in October?”, “Who is still waiting for my reply?”, “Draft an answer to Sarah”. You see every search it runs and every message it opens.

  • Your key, your account. Stored encrypted with your other logins. Your AI provider bills you directly, and the app shows tokens per month (and cost for Claude).
  • Straight from your browser. Requests go directly to your AI provider or to your own computer, never through our servers.
  • Search, read, draft. Nothing else. It searches at your provider, opens only the messages it found and can save a draft. It has no way to send, delete or move mail.
  • Opt-in per mailbox. The AI cannot see a mailbox you have not enabled.
  • Mail is data, not instructions. An email that tries to give the AI orders (prompt injection) can at worst produce a draft you review.
  • Supported models. Anthropic Claude (Opus, Sonnet, Haiku). OpenAI-compatible APIs: OpenAI, Mistral, OpenRouter, Groq, DeepSeek. Local models with Ollama or LM Studio, where nothing leaves your computer. Smaller local models handle multi-step questions less reliably.

Which invoices came in October?

→ search_mail {"text": "invoice", "since": "2026-10-01"}
← 2 hits  m1 Power company · m2 Accounting
→ read_mail   {"id": "m1"}
→ read_mail   {"id": "m2"}

You got 2 invoices in October: from the power company (EUR 48.20, due 31 October) and from accounting (No. 2026-118).

Power companyAccounting

Architecture

Zero-knowledge by design, not by policy. Everything that needs a key or sees plaintext runs on your device. Our side only relays encrypted traffic and stores encrypted data.

Security

Built on established, widely reviewed cryptography. No home-made algorithms.

Password never sent

Your account password never leaves your browser, not even when you sign up. The server keeps no conventional password hash.

Encrypted vault

Mailbox logins, settings and your AI key are encrypted in your browser before they are stored. Only your browser can decrypt them.

Device-only option

Keep the vault on one device and the server holds nothing, not even encrypted. The local copy of your mail is encrypted too.

Recovery key and TOTP

A recovery key is the only way back if you forget your password. Optional two-step verification and remembered devices you can revoke.

Strict STARTTLS

TLS or STARTTLS, never a downgrade: if encryption fails, the connection closes before your login is sent. Self-signed certificates need your explicit trust.

Safe HTML mail

Messages are cleaned and shown in a sandbox where scripts cannot run. Remote images and tracking pixels stay blocked until you allow them.

Threat model, plainly

Zero-knowledge covers keys and content, not every piece of metadata. To relay your connections we still see a few things, and we would rather you know exactly which.

We cannot see

  • Your account password or mailbox passwords
  • Message bodies, subjects, attachments, senders or recipients
  • Your search queries or what you ask the AI
  • Your AI provider key
  • Any key that would decrypt your data

We can see

  • Which mail servers you connect to (e.g. imap.example.com:993)
  • When you connect and how many bytes pass through
  • Your account email address
  • The size of your encrypted data
  • Like any web app, you trust the code we serve on each visit

Features

Unified inbox

All mailboxes in one list, each with its own colour. Replies go out through the mailbox the message came to.

Push via IMAP IDLE

New mail arrives as it lands while the app is open, with notifications when the tab is in the background.

Search two ways

Instant search in the encrypted local copy, and server-side search for the full archive.

Automatic setup

Server settings are found from your address; manual host, port and TLS mode when you need them.

Proper compose

Rich text or plain, drafts saved over IMAP, undo send, attachment and missing-subject checks.

Ask your mail

Bring-your-own-key AI with search, read and draft tools across every enabled mailbox.

FAQ

Is this end-to-end encryption?

The connection is: encryption runs from your browser all the way to your IMAP/SMTP server, and we only pass it along. Your mail stays at your provider as it always was; inboxhub does not add PGP-style encryption to the messages themselves. What we store (your logins, your settings) is encrypted with keys we never have.

Why are Gmail and Outlook not supported?

Both push you to OAuth sign-in and restrict password access. inboxhub targets standard IMAP/SMTP with a password or an app password: Fastmail, mailbox.org, Purelymail, Migadu, self-hosted Dovecot and Postfix, and most hosting providers.

What happens when the tab is closed?

Nothing runs. All keys live in your browser, so our servers can neither fetch nor send mail for you. That also means no server-side rules or scheduled sending; use Sieve at your provider for filters.

What if your servers were compromised?

An attacker would get encrypted data, login records and connection metadata, none of which reveal passwords or mail. The real risk for any web app is modified JavaScript served to you; that is the trust you place in us on each visit.

Where is it hosted?

On our own servers in the European Union. Your mail itself stays with your provider.

What if I forget my password?

Use the recovery key you saved when creating the account. Without it, nobody can decrypt your data, including us; you would connect your mailboxes again to a new account.