thelemail/web-client
The production app you use in the browser.
Key generation, mailbox decryption and supported end-to-end encryption happen here. This is the code that keeps stored mailbox content unreadable to the service.
The clients that hold your keys are published.
Stored mailbox content is ciphertext. The production browser client, macOS desktop client, key transparency log and local export tool are public.
Published
What you can read today.
thelemail/desktop-client
The macOS app with keys, encrypted local mail and offline search on your computer.
A Tauri shell around the web-client UI with a Rust core. Cryptographic operations stay out of the webview, and mail is mirrored into a local SQLCipher database for offline reading and search.
thelemail/keylog
The transparency log behind the key directory.
A signed append-only log that records every public key we publish for an address. It was accepted into the Witness Network staging list on 1 September 2026; its checkpoints now carry witness cosignatures, and client enforcement is not active yet. It knows nothing about mail: it takes an opaque record and returns a proof.
thelemail/export-tool
The local CLI that downloads and decrypts your mailbox.
It authenticates with OPAQUE, unlocks the wrapped account key on your computer and exports standard MBOX files. It runs locally and can resume an interrupted export.
What is not public.
The browser and desktop clients, keylog and export tool are public. Mobile client source is not published.
Mobile client sourcePrivate
Mobile client source is not published. The inspectable client and deployment claims on this page apply to the production browser app.
Source to production
Check what production is actually serving.
Each release is built from a signed tag by a workflow in the public repository, signed with cosign, and promoted by digest. Production tells you which commit it is serving.
thelemail/web-client commit dbc611ac0ea1 deployed September 16, 2026
thelemail/keylog commit f4f9905b524f · v0.1.0 deployed August 28, 2026
The export tool runs on your own computer, so it has no production deployment to poll.
Release and deployment values on this page were read from GitHub when the site was last built, on September 16, 2026. Run the commands below for the live answer.
Ask production what it is running
curl https://app.thelemail.com/.well-known/thelemail-deployment.json
Confirm the image was built by that repository
Fails unless the image came from a v* tag in the public repository's own build workflow.
cosign verify \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-identity-regexp '^https://github\.com/thelemail/web-client/' \ ghcr.io/thelemail/web-client@DIGEST
Read the commit out of the build provenance
Ties the image back to a commit you can read on GitHub.
gh attestation verify oci://ghcr.io/thelemail/web-client@DIGEST \ --repo thelemail/web-client
Or read the rollout history
Every promotion to production is recorded in the public repository.
gh api repos/thelemail/web-client/deployments
These four product components are AGPL-3.0. Run them, change them, publish the changes. If you operate a modified version as a service, the licence asks you to publish that too.
Fay ce que vouldras. The only rule of the Abbey of Thélème. Rabelais, Gargantua, 1534.
We wrote down what we can't protect.
The threat model spells out what is encrypted, what is not, and what a server compromise would and would not expose. The gaps we haven't closed yet are listed with it.