How ProtectMyMail works
Beta · Last updated: 4 September 2026
ProtectMyMail is a browser plugin and desktop app that adds three things ordinary email cannot do: it proves who really sent a message, it catches messages changed in transit, and it encrypts your mail end to end. You keep your address, your provider and your mail program.
Your keys are created on your own device and never leave it. Your message content is encrypted in your browser before it is sent. Only an unreadable package is ever stored on the way, so no one can read your mail, and neither can we.
1. What it is, and why
Ordinary email has two weak spots. Anyone can put any name in the "from" field, so you cannot be sure who really wrote to you. And your provider can read everything you send and receive. ProtectMyMail fixes both, without asking you to leave Gmail, Outlook or any IMAP inbox.
It runs as a browser plugin (for Gmail and Outlook on the web) or as a small desktop app that works with any mail program (Outlook, Thunderbird, Apple Mail, or webmail). You keep your current address and provider.
2. How it works
Signing: proving the message is real
When you send a message, the plugin makes a short fingerprint of the exact text and signs that fingerprint with a private key that only you hold. The signature is published to the ProtectMyMail directory. When your recipient opens the message, their plugin fetches the signature, checks it, and compares it against the message actually in front of them.
If the text was changed on the way — a swapped bank account number, a replaced link — the fingerprints no longer match, and the recipient is warned before they act on it.
Verifying the sender: tying a key to an address
A separate step ties an email address to a key. A one-time challenge is sent to the mailbox and returned. Only that turns a merely signed message into a verified sender. Anyone can claim any address; only someone who can actually read that mailbox can prove it. This confirmation is valid for six months, then it is renewed.
Encryption: mail only you can read
Between ProtectMyMail users, message content is encrypted in your browser before it leaves, using modern authenticated encryption (AES-256-GCM) with a per-recipient key exchange (X25519). Your provider cannot read it, and neither can we. Mail to and from people who do not use ProtectMyMail is bridged to ordinary email and labelled honestly, never dressed up as more secure than it is.
3. What the labels mean
Every message carries an honest label, so you always know how sure the plugin really is. Most email is ordinary email; marking all of it as suspicious would only train you to ignore the warning. The plugin flags a problem only when there is a real one.
| Label | What it means |
|---|---|
| verified sender | The sender proved they control that mailbox, and the message reached you exactly as written. |
| end-to-end | Encrypted between you and the sender. Only the two of you can read it. |
| signed, unconfirmed | The signature is valid, but the key is not yet confirmed against the address. |
| new key | Signed and intact, but this person previously wrote with a different key. |
| altered | The sender signed different text than you are reading. Treat with care. |
| look-alike domain | The domain is a near-miss of one you correspond with. |
| authenticated | Ordinary email whose sending domain checked out (SPF / DKIM / DMARC). |
| unverified | Ordinary email whose sender could not be verified. Handle with care. |
Important: no warning does not by itself mean a sender is trustworthy. It means the plugin found nothing it can prove either way.
4. What is stored, and who can see it
- Your keys are generated on your own device and never leave it.
- Your message content is encrypted before it is sent. Only an unreadable package is ever stored on the way. We cannot read it, and neither can your provider.
- Public records — signatures and the public part of a verified key — are stored so recipients can check a message. These never contain your message text.
5. Setting it up
Setup takes about ten minutes and needs no separate account signup.
- Pick the right one — the browser plugin for Gmail or Outlook on the web, or the desktop app for any other mail program.
- Create your key — enter your email and a passphrase; the key stays on your computer.
- Confirm your mailbox — paste a one-time code sent to your address.
- Write down your recovery phrase — twelve words on paper. It is the only way back into your account if you lose your device.
There is no company-held copy of your keys. If you lose both your device and your recovery phrase, we cannot restore your account. That is the price of mail only you can read.
6. The Scan add-on — coming soon
An optional Scan add-on is planned. When it launches, it will check every incoming attachment for malware and check links against known phishing, before they reach your inbox. Suspicious mail will be flagged for your review, never silently deleted. No scanner blocks every threat, and we will say so plainly. Scan is not live yet.
7. Honest limits
ProtectMyMail is early Beta software. It works and is in daily use on a test setup, but you should know exactly what it does not do before you rely on it for anything that matters. We make no guarantee that it catches every threat or never fails.
- Not independently audited. It has not yet had a third-party security audit.
- No mobile version yet. Most mail is read on a phone; there is no mobile app at launch.
- The subject line is not encrypted. Only the message body is.
- Metadata is not hidden. Who you write to, and when, is still visible.
- "Verified" means one specific thing: someone proved control of that mailbox within the last six months. It is not a real-world identity check.
- An attacker who takes over your mailbox can publish a new key and send valid protected mail as you.
- No forward secrecy. If your recovery phrase is recovered, past encrypted messages can be read.
- The apps are not code-signed yet, so your operating system may warn about an unrecognised publisher.
8. Glossary
- Key — the private secret on your device that signs and decrypts your mail.
- Signature — proof that a specific message came from a specific key, unchanged.
- Verified sender — a signature plus a confirmed link between the key and the mailbox.
- Recovery phrase — twelve words that can rebuild your key if you lose your device.
- Bridge — how ordinary email to and from non-users is passed through and labelled honestly.
9. Updates & source
Plugin updates and, later, the Scan documentation are published on our public GitHub. This is where you can follow what changes and when.
github.com/acaitechnology — updates and technical notes.