Mailvelope is a browser extension for Chrome, Firefox and Edge that adds OpenPGP end-to-end encryption to webmail (Gmail, Outlook.com, Yahoo, WEB.DE/GMX/Posteo and any user-authorized domain), developed since 2012 by Thomas Oberndörfer and operated by Mailvelope GmbH, a small German company (Zellingen, HRB 15999 Amtsgericht Würzburg) that also sells a Business tier for Google Workspace and Nextcloud. Its Data Protection Policy states the extension stores data only in the browser's local storage, keeps private keys on the device, and never transmits email content to a Mailvelope server; the disclosed caveats are that newly generated public keys are uploaded to the Mailvelope key server by default (revocable, verified by email), that default-on key lookups send contact email addresses to the Mailvelope key server, keys.openpgp.org and WKD hosts, and that a consent-gated, sampled Clean Insights analytics prompt exists (disabled entirely on Chrome/Edge since v6.0). The code is AGPLv3 on GitHub, the company names OTF and Internews grants and 1und1/Deutsche Telekom partnerships, and the project publishes an audit history from Cure53 (2013-2017), iSEC (2014) and SEC Consult/BSI (2019) through a current OTF-funded 0xche audit (Jan-Jul 2025) whose one High finding was fixed and whose WKD-metadata finding was left unfixed with a settings toggle. No breach or regulatory action was found; the browser-extension threat model itself (a hostile webmail page) is the structural caveat, mitigated by sandboxed iframes per the audits.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
Mailvelope's FAQ states that encryption and decryption are handled locally on the user's computer so the webmail provider cannot read encrypted messages, and that the private key never leaves the computer; the FAQ also states that by default Mailvelope automatically publishes newly generated keys to its key server, with an opt-out offered during key creation and removal possible later.
Mailvelope's Data Protection Policy (last modified March 28, 2022) states the extension stores data only in the browser's local storage, that the only sensitive data it holds are PGP keys (containing user name and email) in its local keyring, and — for the Gmail integration — that emails are processed only in the local installation and never transmitted to a Mailvelope server; it also discloses two default-on flows that move data off-device: newly generated public keys are uploaded to the Mailvelope key server unless the user opts out, and key searches send a contact's email address to the Mailvelope key server and keys.openpgp.org.
Mailvelope's About page dates the project's history: development began in early 2012 by Thomas Oberndörfer with source published under AGPL3, funding by the Open Technology Fund since September 2013 with the first security audits, cooperation with 1und1 from August 2014 (GMX/WEB.DE integration in 2015), the founding of Mailvelope GmbH in January 2015, and Deutsche Telekom/United Internet adopting Mailvelope-based PGP for De-Mail in 2015 — disclosing the company's funders and commercial partners but not its shareholders.
Mailvelope's Legal Notice identifies the operator as Mailvelope GmbH, Gassenwiese 38, 97225 Zellingen, Germany, registered as HRB 15999 at Amtsgericht Würzburg with VAT ID DE298811578, and names Thomas Oberndörfer as CEO — a filed legal entity with a public register number rather than an informal project.
The Mailvelope repository's LICENSE file (master branch) is the full GNU Affero General Public License version 3, so the extension's complete running code — 2,222 commits with a public contributor list under the mailvelope organisation on GitHub — is inspectable, auditable and forkable by anyone.
The Mailvelope Key Server's README (the server behind keys.mailvelope.com, AGPLv3) describes it as a public directory that serves uploaded OpenPGP public keys — including the user's name and verified email address — to any client that queries by email, key ID or fingerprint, and openly states this design places more trust in the service provider than the web-of-trust model, while allowing key deletion to address the privacy problems of legacy SKS servers.
The Data Protection Policy states that emails and user data are processed only in the local installation of the extension and are never shared with any third party nor transmitted to a Mailvelope server; that Mailvelope will not sell personal data and shares it only with prior explicit consent or where legally required, that no government request has ever been received, and that its web, download and key servers are located in Germany. Disclosed subprocessors are limited to the paid Business tier (Chargebee) and the newsletter (Mailjet).
The 0xche security audit of Mailvelope v6.0.1 (report v3, July 15, 2025) documented as an informative privacy finding that default-on Web Key Directory lookups automatically make HTTPS requests to a sender's own domain containing the encoded local part of the address, potentially exposing user information to third-party hosts; the retest records this finding as 'No fix applied', with Mailvelope noting WKD can be disabled in the extension's settings.
The published 0xche audit report of Mailvelope v6.0.1 (white-box, tested Oct 10 - Dec 22, 2024; report v1 Jan 31, 2025; retest v3 Jul 15, 2025; recipients Mailvelope and Open Tech Fund) recorded one High (clickjacking via web-accessible extension pages), one Low (prototype pollution) and five informative findings; the retest marks the High and Low as Fixed, and the report concludes the extension maintains strong security boundaries with a well-restricted permissions model. This is the only named-firm audit inside the five-year window.
Mailvelope's public Security wiki (edited April 15, 2026) lists ten named-firm security audits — 0xche (Feb 2025), SEC Consult for the German BSI (Feb 2019), Cure53 for Posteo (Feb 2017), Cure53 for 1und1 (Dec 2015, Jul 2015, Dec 2014, Oct 2014), iSEC Partners for OTF (May 2014), Cure53 OpenPGP.js audit for OTF (Feb 2014) and Cure53 Chrome-extension pentest for OTF (Feb 2013) — and publishes a fixed-vulnerability list including CVE-2019-9147 through CVE-2019-9150 and a signature-spoofing advisory fixed in v6.1.0. All audits other than the 2025 one are more than five years old and are disclosed history rather than current assurance.
Privacy Guides lists Mailvelope (Browser) on its Email Clients recommendations page, whose published minimum qualifications include that a client must not collect telemetry or must offer an easy way to disable all telemetry, and must support OpenPGP message encryption.
Mailvelope's FAQ states that with v6.0 and the move to Manifest V3 all analytics features were disabled on Chrome and Edge; on other browsers, from v5.2 only 1% of installs are shown a consent dialog, no analytics are collected without consent, and consenting users report only a fixed list of coarse events (first load, key generated/uploaded, verification email decrypted, email encrypted, email decrypted) recorded once a day, with consent withdrawable in Options.
The Data Protection Policy discloses the extension's only analytics as consent-gated: during setup Mailvelope asks the user for consent to share aggregated, anonymized usage data via the Clean Insights platform (no tracking cookie, no stored IP addresses, no cross-site tracking), while also stating that Matomo is used to collect extension usage information; the website itself uses cookieless Plausible and the download server logs anonymous technical data. No third-party advertising or tracking SDK is disclosed.