Questions

Answered directly, including the ones with awkward answers.

Using it

Do I need a new e-mail address?

No. You keep your address, your provider and your mail program.

Does the other person need it too?

Not to receive your signed mail — it arrives as normal mail with a short reference line at the bottom. They need it to see the verdict, and they need it before you can encrypt to them.

Will my mail look strange to people who do not have it?

A signed message looks normal, with one extra line below a -- separator; most mail programs tuck that away as a signature block. An encrypted message is not readable to them, which is why the plugins only offer encryption when the recipient has a published key.

Does it work on my phone?

Not yet. There is no mobile version. Mail you receive on a phone is unaffected — it just arrives without a verdict.

Does it slow anything down?

Signing takes a fraction of a second. Reading a verdict needs one small lookup, cached afterwards. You are unlikely to notice either.

What if the network is down?

Sending: your mail goes out unprotected rather than not at all. Reading: you see "could not be checked" rather than a false verdict. Nothing is ever assumed to be fine because a check failed.

What it actually proves

Does "verified" mean the person is who they say?

No — and this is the most important thing on this page. It means they proved they can read that mailbox. If a stranger registers your-bank-support@gmail.com and confirms it, they get a verified badge on that address. The badge tells you the address is genuinely theirs. It does not tell you the address is who you think.

Could someone fake a badge?

Not without your private key, which never leaves your computer. Someone who took over the whole network could stop a badge appearing; they could not manufacture one.

Is a green badge enough to act on a payment change?

No. It proves the message came from that mailbox unaltered. It does not prove the request is sensible, and it does not help if the mailbox itself was taken over. For payment instructions, confirm by phone on a number you already had.

What exactly does the signature cover?

The sender's address, the subject line, the text of the body, and whether the message was sealed. It does not cover attachments, and it does not yet bind the message to its recipient — so a genuine protected message could in principle be re-sent to somebody else with its proof intact. Its text and subject would still have to be the original ones. Closing that is on the list.

Keys and recovery

What if I lose my recovery phrase?

Mail already sealed to your old key cannot be recovered by anyone. You can create a new identity and confirm your mailbox again; your correspondents see a "new key" warning for thirty days. See your recovery phrase.

Can you recover it for me?

No. We never had it. If we could recover your identity, so could anyone who convinced us they were you.

What if someone takes over my mailbox?

They can publish a new key and send verified mail as you. Everyone who receives it is warned that your key changed, for thirty days. That warning is the strongest protection here, which is why key changes are never accepted silently.

The awkward ones

Has this been audited?

No. There has been extensive internal testing and every component has been reviewed adversarially — which found real defects, including a way to have a forged signature shown with somebody else's verified badge. That process is valuable and it is not the same as an independent audit. Weigh it accordingly.

Why does my computer warn me when I install it?

The downloads are not yet signed with a paid publisher certificate. The warning is real and you are right to take it seriously.

Is it free?

The clients are free and the source is public. Running gateways costs money, so paid plans for organisations are planned. Nothing you install today starts charging you.

What happens if you stop working on this?

The source is on GitHub and the network is not ours to switch off — anyone can run a node. Mail already sent stays valid and verifiable. That is a real answer, not a guarantee: if nobody ran a node, lookups would stop working, and your mail would go back to being ordinary mail.

Why should I trust you?

Ideally you should not have to. Your keys are made on your machine and never sent anywhere; your plugin verifies every record itself rather than believing what a server says; and the code is public so someone who knows what they are looking at can check that these sentences are true. The parts where you do currently have to trust something are listed on the honest limits page.

← All documentation