You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Tankred Hase 5d09e32320 Merge pull request #141 from whiteout-io/dev/WO-567
Dev/wo 567
9 years ago
config Add production config file 9 years ago
res Add mobile homescreen icons and cca build scripts 9 years ago
src [WO-567] fix TLS worker handling 9 years ago
test Stub GET requests to key server in integration test 9 years ago
.gitignore Integration test works again 9 years ago
.jshintrc Browserify runtime dependencies work 9 years ago
.travis.yml update readme and change deps to https github tarballs 10 years ago
Gruntfile.js [WO-567] fix TLS worker handling 9 years ago
LICENSE.txt Update LICENSE.txt 9 years ago Update 9 years ago
package.json [WO-567] use mailreader v0.4.0 9 years ago
server.js [WO-594] Return own hostname for 'hostname' call from 9 years ago

App Icon

Whiteout Mail Build Status

Whiteout Mail is an easy to use email client with integrated OpenPGP encryption written in pure JavaScript. Download the official version under


You can read about product features and our future roadmap in our FAQ.

Privacy and Security

We take the privacy of your data very seriously. Here are some of the technical details:

  • Messages are encrypted end-to-end using the OpenPGP standard. This means that only you and the recipient can read your mail. Your messages and private PGP key are stored only on your computer (in IndexedDB).

  • Users have the option to use encrypted private key sync if they want to use Whiteout on multiple devices.

  • Content Security Policy (CSP) is enforced to prevent injection attacks.

  • HTML mails are sanitized with DOMPurify and are rendered in a sandboxed iframe.

  • Displaying mail images is optional and opt-in by default.

  • Like most native email clients, whiteout mail uses raw TCP sockets to communicate directly with your mail server via IMAP/SMTP. TLS is used to protect your password and message data in transit.

  • The app is deployed as a signed Chrome Packaged App with auditable static versions in order to prevent problems with host-based security.

  • The app can also be used from any modern web browser in environments where installing an app is not possible (e.g. a locked down corporate desktop). The IMAP/SMTP TLS sessions are still terminated in the user's browser using JS crypto (Forge), but the encrypted TLS payload is proxied via, due to the lack of raw sockets in the browser. Please keep in mind that this mode of operation is not as secure as using the signed packaged app, since users must trust the webserver to deliver the correct code. This mode will still protect user against passive attacks like wiretapping (since PGP and TLS are still applied in the user's browser), but not against active attacks from the webserver. So it's best to decide which threat model applies to you.

Reporting bugs and feature requests

  • We will launch a bug bounty program later on for independant security researchers. If you find any security vulnerabilities, don't hesitate to contact us

  • You can also just create an issue on GitHub if you're missing a feature or just want to give us feedback. It would be much appreciated!


You can download a prebuilt bundle under releases or build your own from source (requires node.js, grunt and sass):

npm install && npm test

This will download all dependencies, run the tests and build the Chrome Packaged App bundle which can be installed under chrome://extensions in developer mode.


For development you can start a connect dev server:

grunt dev

Then visit http://localhost:8580/dist/#/desktop?dev=true for front-end code or http://localhost:8580/test/unit/ to test JavaScript changes. You can also start a watch task so you don't have rebuild everytime you make a change:

grunt watch

Releasing Chrome App

grunt release-test --release=0.0.0.x
grunt release-stable --release=0.x.0

Deploying Web App & Selfhosting

The App can be used both as a Chrome Packaged App or just by hosting it on you own trusted web server.

First build and generate the dist/ directory:


Then start the server and navigate to http://localhost:8585 (or whatever port is set using the PORT environment variable):

npm start

A note on security: The app should not be used without SSL so it's best to set up a reverse proxy or Loadbalancer with your SSL certificates. If you are not sure how to do this it might be easier to use our managed web hosting or packaged apps under


Copyright © 2014, Whiteout Networks GmbH. All rights reserved.

The code is open for inspection and peer review by the security community.
The code is currently not licensed under an open source license. If you're
interested in contributing or getting a license, please get in touch with
us (

Third party libraries

We work together with existing open source projects wherever possible and contribute any changes we make back upstream. Many of theses libraries are licensed under an open source license. Here are some of them:

  • OpenPGP.js (LGPL license): An implementation of OpenPGP in Javascript
  • email.js (MIT license): IMAP, SMTP, MIME-building and MIME-parsing engine
  • Forge (BSD license): An implementation of TLS in JavaScript