About Mailvelope
Mailvelope adds PGP encryption to webmail, so that only you and your recipient can read a message. Normally your email provider can read what you send. With Mailvelope the message is encrypted in your browser with the recipient's public key before it reaches Gmail or another provider. It is developed by Mailvelope GmbH in Germany.
You create or import a key, then compose in a separate Mailvelope window that your webmail cannot read. It works with Gmail and many other providers, and it has deeper integrations with WEB.DE, GMX and Posteo. A paid Mailvelope Business tier targets Nextcloud and Google Workspace, while the version for private users is free. The code is public on GitHub under AGPL-3.0.
Be realistic about the effort. End-to-end email only works when the other person also has PGP, and managing keys is not simple. Its privacy policy says that with the Gmail integration your email is not sent to Mailvelope's servers, but that keys can be uploaded to its key server and address lookups are sent, both on by default. It asks for all websites and Gmail API read and send scopes. It is the best fit for journalists, activists and anyone who already uses PGP.
Pros and cons
- End-to-end PGP encryption for Gmail, Outlook, Yahoo and more
- Open source under AGPL-3.0, from a German company
- Free for private users
- Says Gmail messages are never sent to its servers
- Recipients need PGP keys too, which is a hurdle
- Setup and key management take effort
- Key upload to its key server is on by default
Permissions
It requests access to all websites to attach its encrypted compose and read windows to webmail, plus identity and Gmail API read and send scopes for its Gmail integration. Native messaging is optional.
