Honest limits

What this does not protect, and what an attacker can still do.

A security page that only lists strengths is worth nothing to anyone deciding whether to rely on it. These are the real limits.

Not audited

There has been no independent security audit. There is extensive internal testing, and every component has been reviewed adversarially — which found several real defects, including a way to have a forged signature displayed with someone else’s verified badge. That process is valuable and is not the same as an audit.

Metadata is not hidden

The contents of a protected message are encrypted. Who you write to, and when, is not. Mail providers need that to deliver, and the network can see it too. If your risk is about who you talk to rather than what you say, this is not the right tool.

The subject line is not encrypted

Only the body is. Subjects often carry as much as the message — if it matters, keep it out of the subject.

“Verified” means one specific thing

It means someone proved control of that mailbox at some point in the last six months. It does not mean they are who they say in the world, and it does not mean the mailbox has not changed hands since.

An attacker with your mailbox

Someone who takes over an account can publish a new key and send valid protected mail. Everyone who receives it is warned that the key changed, for thirty days — which is the strongest signal here, and why key changes are recorded rather than accepted silently. But an attacker who compromises a device and uses the existing key is indistinguishable from its owner. No key-based system solves that.

No forward secrecy

Your encryption key is fixed. Someone who later obtains your recovery phrase can read past protected mail sent to you. Fine for invoice fraud; not fine if your threat model includes a device being seized later.

Lose the phrase, lose the key

There is no recovery. That is the direct consequence of no company holding your keys, and it is a real cost, not a slogan.

Other gaps

• No mobile version — most mail is read on a phone.
• The binaries are not code-signed, so Windows and macOS will warn about them.
• Not in the Chrome Web Store or Microsoft AppSource yet.
• The browser plugin reads Gmail’s rendered page, which Google can change without notice. It does nothing rather than guess when it does not recognise the layout — a safe failure, but still a failure.

← All guides