Sealed Mailbox
A small message relay you can read in an afternoon. It stores fixed-size ciphertext in a mailbox it cannot open, and it learns nothing about you beyond the fact that some mailbox existed for a while.
What this is not
- There are no accounts. There is no sign-up, no email, no phone number.
- There is no password reset. If you lose your 12 words and your browser data, your mail is gone.
- There is no server-side backup, and we cannot enable one for you. We do not hold your keys.
- This is a proof of concept, not a product. Do not use it for anything that matters yet.
How it works
You get one mailbox per contact. Each mailbox has a random 16-byte address, a write capability you hand to that one contact, and a read capability that never leaves your device.
- Every message is exactly 16,384 bytes on the wire. Message length is not recorded, so it cannot leak.
- Encryption happens in your browser with X25519 and AES-256-GCM. The private half never reaches the server.
- Mail is written with a capability, not an identity. The server cannot tell who sent you anything.
- Tokens are stored only as SHA-256 hashes, so a database dump contains no usable capability.
- Mailboxes delete themselves on a timer. The server keeps no log.
Threat model
What this protects. Message content. Who sent you a message. Who you talk to, as far as the server can see, because there is no per-person identifier to correlate on. Message length and message count, since every envelope is the same size.
What this does not protect. Your address is visible to whoever runs the platform underneath. Cloudflare terminates TLS, so it sees the IP address you connect from even though this application never stores it. A single operator also cannot give you the guarantees of an onion network, which depend on several parties who would have to conspire. Padding does not hide when you send; only cover traffic would, and this does not generate any.
What it means in practice. If you trust the operator to run the code you are reading, this is a much smaller pile of metadata than a normal messenger. If you do not, run your own copy. That is the honest summary, and it is why the source is short.