🔐
Encrypt and sign in one click
PGP/MIME (RFC 3156) for every message, optional hidden subjects, and a copy encrypted to you so your Sent folder stays readable.
OpenPGP built in · Works with your email account · Free and open source
PGP email that follows you across devices.
Sealpost is an email client with excellent OpenPGP support for Windows, macOS and Linux. It works with the email account you already have. Add Sealpost Server to your own website for webmail on that same account, kept in sync with the desktop app — in any browser, and as an app on your iPhone or Android home screen.
Free for Windows 10/11, macOS 12+ and 64-bit Linux. Works with any IMAP mail account.
🔐 OpenPGP — PGP/MIME + inline🔄 Synced on every device🗝 Keys from WKD + keys.openpgp.org🛡 Remote images blocked🪟 Windows · 🍎 macOS · 🐧 Linux📱 Webmail on iPhone & Android, on your own site
Everything a PGP mail client should be
Encryption that's there when you need it and invisible when you don't — on whichever device you're using right now.
✔
Reads everything PGP
PGP/MIME, inline PGP, signed-and-encrypted mail and encrypted .pgp attachments — with clear warnings for bad signatures or a signer who isn't the sender.
🗝
Key management built in
Create Curve25519 or RSA-4096 keys, import from files, mail or Autocrypt, look keys up online, publish yours, extend expiry, revoke. The composer shows who has a key as you type.
🔄
Your setup, every device
Accounts, passwords, contacts, keys and settings sync between your computers and Sealpost Web through your own website — encrypted before they leave the device. Your mail itself stays with your email provider.
📬
A real mail client
Several IMAP accounts, All Inboxes, folders and Favorites, conversation view, drag-to-move, "Send as" addresses, instant new-mail push and keyboard shortcuts.
🛡
Safe reading
HTML mail opens in a sandbox with no scripts, tracking pixels stay blocked until you click Load images, and links open in your browser.
✈
Works offline
Keep an encrypted copy of recent mail on your computer. Read and write with no connection; the Outbox sends by itself when you're back.
🔒
Locked on your computer
Passwords are kept with Windows, the Mac Keychain or your Linux keyring. Add a PIN or Windows Hello, and one encrypted backup file moves everything to a new PC.
Up and running in three steps
- 1
Install and add your account
Pick your provider — Gmail, Outlook, Yahoo, iCloud, Fastmail, Proton Bridge, Zoho, cPanel or any IMAP server — click Test connection and save.
- 2
Create or import your key
Sealpost offers to make a PGP key for your address, or bring the one you already use with GnuPG or Kleopatra. Back it up from Keys and you're set.
- 3
Optional: webmail and sync on your own website
Put Sealpost Server on your website, then Settings → Sync with my web server. Your other computers and the webmail — in a browser or on your phone — get the same accounts, contacts and keys.
The same mail everywhere
- Your keys follow you. Secret keys sync still locked by their own passphrase — or tick "remember on all my devices" and every device unlocks them.
- Drafts open anywhere. Start on your PC, finish on your phone. Drafts are encrypted to your own key on your mail server.
- Contacts keep their rules. Pinned keys and "always encrypt" settings travel with each contact.
- Each device stays its own. PINs, the offline copy and other per-device choices never leave the device.
How your mail and keys are protected
Standard OpenPGP that works with everyone else's PGP software — and an honest list of the limits.
What Sealpost does
- OpenPGP (OpenPGP.js): mail encrypted to your contacts' keys and signed with yours, readable by any standards-compliant PGP program.
- Zero-knowledge sync. Your vault passphrase never leaves your device. Your Sealpost settings, contacts and keys are sealed with AES-256-GCM before they're sent; your website only stores ciphertext (your mail isn't kept there).
- Sealpost Web decrypts in your browser. Keys are unlocked and mail is decrypted on your phone or computer, never on the server.
- Remote content blocked. No scripts in mail, no tracking pixels until you allow them, links always open outside the app.
- Encrypted on disk: passwords locked to your Windows account, Mac Keychain or Linux keyring; the offline copy is encrypted to your PIN.
- Open source (GPL-3.0) — read every line on GitHub.
Good to know
- Sealpost doesn't encrypt your mailbox. Your mail stays on your email provider's servers. Mail that was PGP-encrypted stays encrypted there; ordinary, unencrypted mail stays as readable to your provider as before — neither Sealpost nor Sealpost Server changes that.
- App passwords, not "Sign in with Google". Gmail, Yahoo, iCloud and Fastmail need an app password. Some Microsoft 365 workplaces turn password sign-in off entirely.
- Mail metadata isn't hidden. PGP protects the message body and attachments (and, if you choose, the subject). Sender, recipients and dates are visible to the mail servers, as with any email.
- Your passphrases can't be recovered. Forget them and nobody — including your server — can open your key or vault. Keep the backup Sealpost offers.
- Sealpost Web uses your server as a bridge. Your browser sends your mail password with each request so the server can talk to your mail provider; it isn't stored. Whoever controls your hosting controls the page your browser runs.
- No S/MIME, and no push notifications on iPhone or Android (they would need your mail password kept on the server).
Download Sealpost
Version 1.12.0 · released October 25, 2026 · release notes on GitHub
Windows
Windows 10 and 11, 64-bit
SHA-256 checksum
da3ca8104583fbfb2fab989857744d7387f11b2e457df5a573ec5adb0b2584femacOS — Apple Silicon
M1 and newer, macOS 13 Ventura or later
Which Mac do I have? · First start
SHA-256 checksum
5608e783c20de7d694e4aac53c4fb74b2faeccaa4f7e435272a0590197d2f29dStill on macOS 12 Monterey?
Only for Macs that can't upgrade to macOS 13 or newer. If yours can, use the download above.
- Built on an older engine (Electron 43). It gets security fixes only until that version is retired.
- macOS 12 itself no longer gets security updates from Apple.
- It takes the same Sealpost updates for now, but may stop getting new versions in the future.
Download the macOS 12 version (.dmg · 1.12.0 · 122 MB)
SHA-256 8b0772f4b872e1dd78b7714888a8b9298ecd15fd84f775dc9992e192a209410e
macOS — Intel
Intel Macs, macOS 13 Ventura or later
Which Mac do I have? · First start
SHA-256 checksum
00b353d6af17b71524337289215273e2ab7b98ab843089fbd716f188cb5c9233Still on macOS 12 Monterey?
Only for Macs that can't upgrade to macOS 13 or newer. If yours can, use the download above.
- Built on an older engine (Electron 43). It gets security fixes only until that version is retired.
- macOS 12 itself no longer gets security updates from Apple.
- It takes the same Sealpost updates for now, but may stop getting new versions in the future.
Download the macOS 12 version (.dmg · 1.12.0 · 128 MB)
SHA-256 f8855a927e1383712104d484ef014ddb1b679b18e6acef3341a16ee5b526f9c3
Linux — .deb
Ubuntu, Debian, Mint (64-bit)
SHA-256 checksum
66c8fdef07723e76e85321b9a110771de86927dfeaa7167251c5db7393bae2e1Linux — AppImage
Any 64-bit Linux
SHA-256 checksum
01e53007ac03ab79d84eb00020bc25957bbb65ee8a1813ab12249ce3ca7068b0Update file
For an existing install, any system
SHA-256 checksum
93adf140da91c097dcd51c3be87d38c0ec6aa06955713a29274fc705be9593aeWindows
Run the installer. If SmartScreen says "Windows protected your PC", click More info → Run anyway (the installer isn't code-signed).
macOS
Open the .dmg and drag Sealpost onto Applications. The first time, macOS can't check the app — see first start on a Mac.
Linux
sudo apt install ./Sealpost-*-amd64.deb, or chmod +x the AppImage and run it. Passwords use your login keyring (GNOME Keyring / KDE Wallet).
Already installed?
Settings → About & updates → Check for updates (Sealpost 1.12.0+) finds and installs new versions from GitHub. Older versions: get the update file, then Install update file… — one file for every system.
Want webmail on your phone too? Get Sealpost Server for your website. All files: GitHub releases.
Sealpost on a Mac
The same Sealpost — same accounts, same keys, same vault — for macOS 13 Ventura and newer, with a separate build for macOS 12 Monterey. Standard menu bar, ⌘ shortcuts, and passwords kept in your Keychain.
1. Pick the right download
Click the Apple menu → About This Mac:
- "Chip: Apple M1, M2, M3, M4 …" → get macOS — Apple Silicon.
- "Processor: … Intel …" → get macOS — Intel.
- macOS 12 Monterey? Open "Still on macOS 12 Monterey?" at the bottom of the matching card.
Picked the wrong one? The Intel version also runs on Apple Silicon (more slowly, through Rosetta) — the Apple Silicon version doesn't run on Intel Macs.
2. Install and open it the first time
- 1
Open the .dmg and drag Sealpost onto Applications.
- 2
Open Sealpost from Applications. macOS says it can't check the app — click Done (or OK).
- 3
Open System Settings → Privacy & Security, scroll down and click Open Anyway next to Sealpost. On macOS 12: right-click Sealpost in Applications → Open → Open.
- 4
That's it — from now on it opens normally.
- Why the warning? Sealpost isn't registered with Apple's paid developer program, so macOS can't vouch for it. To be sure your file is the published one, compare its SHA-256 checksum under the download (
shasum -a 256 Sealpost-*.dmgin Terminal). - ⌘ works in place of Ctrl in Sealpost's shortcuts, ⌘-click selects messages, and ⌘, opens Settings.
Webmail on your own website, in sync with the desktop app
Sealpost Server is a small PHP package for your own website. It adds Sealpost Web: webmail for the email account you already have, with the same PGP features as the desktop app, and it keeps your accounts, contacts, keys and settings in sync with Sealpost on your computers. Use it in any browser, or add it to the home screen of an iPhone or Android phone as a web app.
Sealpost Server is not an email server. It doesn't receive, send or store your mail, and it doesn't change how your email provider keeps it. Your email stays with your provider (Gmail, Outlook, iCloud …) — Sealpost Web reads it from there and sends through it, like the desktop app does. Mail that was PGP-encrypted stays encrypted at your provider; ordinary mail stays as it is. What Sealpost Server stores is your Sealpost setup, encrypted by your devices.
💻
Your computers
Sealpost on Windows, Mac and Linux — each one reads mail straight from your provider.
🌐
Your website
Sealpost Server keeps your Sealpost setup in sync — accounts, contacts, keys and settings, all encrypted by your devices. Not your mail.
📱
Browser, iPhone & Android
Sealpost Web unlocks your setup in the browser, reads your mail from your provider and writes, encrypts and signs there.
How it works
- Zero-knowledge. Your vault passphrase never leaves your devices; the server stores only ciphertext and can't read your accounts, contacts or keys. It doesn't store your mail.
- Mail is built in the browser. Sealpost Web signs and encrypts each message on your device, then hands the finished message to your mail provider.
- Home-screen app on iPhone and Android. Unlock with a 6–12 digit PIN (5 tries) instead of the full passphrase — or with Face ID on iPhone.
- One-click server updates. Sealpost Web tells you when a new server version is out and installs it — signed packages only, with Undo. Your
config.phpand vault are never touched. - See and remove devices from any device, at any time.
What you need
- PHP 8 with SQLite, over https — a typical cPanel / shared hosting account. No database server, no PHP imap extension.
- One-click updates also need PHP's curl, zip and sodium (
status.phpshows whether they're ready). - The vault lives outside your public web folder, so it can never be downloaded through the website.
- Keep your hosting account safe. Whoever controls your website's files controls the Sealpost Web page your browser runs.
Install it on your hosting
- 1
Upload the contents of
sealpost-server/from the zip to a folder on your site, e.g./public_html/sealpost/. - 2
Copy
config.example.phptoconfig.phpand set your ownsetup_code. - 3
Open
status.phpin that folder. Every line should be green. - 4
In Sealpost on your computer: Settings → Sync with my web server → Set up sync, enter the folder's address and create your vault.
- 5
Open the folder's address in any browser and sign in with your vault username and passphrase.
- 6
iPhone: open it in Safari → Share → Add to Home Screen, then open Sealpost from that icon, sign in and choose a PIN. Android: open it in Chrome → ⋮ → Add to Home screen (or Install app), then the same.
Sealpost Server + Web
Webmail + sync for your own website (PHP 8)
SHA-256 checksum
aea61556e2c508a3d5021fc84d0c0c5273a5da66bc2e33e3113937200009341dAlready running Sealpost Server 1.10.0 or newer? It updates itself — Sealpost Web shows a card when version 1.10.1 or newer is out.
Open source
Sealpost is free software under the GPL-3.0. Check how it works, build it yourself, or report a problem.
Source code
The app, the server and the tests
SHA-256 checksum
a8f9fe94cdf7c73860b82217339ac0137916d8f7335c408dfb615b07f0e09eb6Sealpost on GitHub
Code, releases and issues
What's new in 1.12.0
- Check for updates (Settings → About & updates): looks for a newer release here on GitHub, then downloads and installs its update file. Sealpost only checks when you click the button.
- Releases on GitHub button opens this releases page.
- Example addresses in Settings now use example.com.
Questions
Do I need Sealpost Server?
No. Sealpost works on its own as a desktop mail client with full PGP. The server adds webmail for your email account, kept in sync with Sealpost on your computers, which you can add to your iPhone or Android home screen — add it whenever you like.
Is Sealpost Server an email server? Does it encrypt my mailbox?
No to both. It doesn't receive, send or store email, and you keep your email address and provider. It's webmail for that account plus sync for your Sealpost setup. Your mail stays on your provider's servers: messages sent or received with PGP are encrypted there, because they were encrypted before they were sent; ordinary, unencrypted mail stays as readable to your provider as it was before.
Which mail accounts work?
Any account with IMAP and SMTP. Sealpost has ready-made settings for Gmail, Outlook, Yahoo, iCloud, Fastmail, Proton Bridge, Zoho (including paid plans) and cPanel hosting. Gmail, Yahoo, iCloud and Fastmail need an app password instead of your normal password.
Can I still email people who don't use PGP?
Yes. Mail to anyone without a key goes out normally. The composer shows, for each recipient, whether a key was found — green when it can encrypt, amber when a key is missing (click it to search online).
I already use GnuPG or Kleopatra. Can I keep my key?
Yes — import your existing key (RSA or ECC) and keep the same identity. It's standard OpenPGP, so your contacts can keep using whatever PGP software they like. Even Sealpost's backup file is an OpenPGP message that gpg --decrypt can open.
Can my server read my mail or my keys?
Not the vault: accounts, contacts, keys and settings are encrypted on your devices with a key made from your passphrase, which never leaves them. For Sealpost Web, your browser sends your mail password with each request so the server can connect to your mail provider — it's used for that one connection and not stored. Mail is decrypted only in your browser.
Does it work on a Mac?
Yes — macOS 13 Ventura or newer on Apple Silicon and Intel, plus a separate build for macOS 12 Monterey. Because it isn't registered with Apple, macOS asks you once to allow it. Step-by-step here.
Can I switch between Windows, Mac, Linux and my phone?
Yes — that's the point. Every device that joins your vault gets the same accounts, contacts, keys and settings, and mail or drafts written on one open on all the others.
Is there an iPhone or Android app?
Sealpost Web is the phone app: open your Sealpost Server's address in Safari on an iPhone (Share → Add to Home Screen) or in Chrome on Android (⋮ → Add to Home screen), and it opens like an app with PIN unlock (or Face ID on iPhone). There's no App Store or Play Store download.
How do updates work?
Every version is published on GitHub. In Sealpost 1.12.0 and newer, Settings → About & updates → Check for updates finds and installs the newest one — Sealpost only checks when you ask. Sealpost Server 1.10.0+ updates itself from signed packages.
What if I forget my passphrase?
It can't be recovered — not by Sealpost and not by your server. That's what keeps your key safe. Back up your secret key and revocation certificate from Keys when you create it, and save an encrypted .sealbackup from Settings.