🤖 The key moments of building keymail — the story, where the prompt ledger is the log. keymail went from an empty directory to a deployed, federated, end-to-end-encrypted mail service in its first two days; this page is the honest short version of how.
The first commit: two federated keymail instances exchanging sealed mail, subject and body encrypted in the browser, first contact gated by proof of work. The test suite greps the recipient server's raw SQLite to prove no plaintext ever hit disk — the one rule, enforced from the first hour.
read the session →The webmail arrives in one long day: inbox, compose, drafts, contacts, archive, undo send — plus passkey sign-in and the encrypted key vault, so an account is a passkey and a sealed blob, never a password.
read the session →The single static binary learns to terminate its own HTTPS (Let's Encrypt, no reverse proxy) and the OpenTofu canaries go up — the same day the first mailbox on keymail.dev is claimed.
read the session →Seven stacked pull requests built unattended while the human slept: end-to-end encrypted attachments, trash with a 30-day purge, Gmail-style address normalisation, a mobile-first inbox, rich text (Markdown, same bytes on every engine) — each deployed to the dev canary and verified in a real WebKit browser before the next began.
read the session →The challenge-MX doorbell lands code-complete: a sender from the old email world gets a doorbell instead of a bounce — prove you're real and your mail is sealed at the door. Dark by design until the MX cutover.
read the session →This site: the carbon tally, the contributor index and the prompt ledger go public at status.keymail.dev, and keeping them honest becomes part of the codebase's own end-of-session routine.
read the session →A native Mac app — no browser, no webview. Sign in by handing a session over from your browser, read threaded conversations that fold the long ones and hide the quoted clutter, and write rich text in a real window. Your mail is unsealed only on your Mac. Download 0.1.0, signed and notarised, and it opens with a plain double-click.
read the session →Moving in stops being a leap. A Gmail Takeout file imports in your browser — every message sealed to your own key before it's stored — or, if your mailbox is enormous, you can hand the fetching to the server after a plain-words consent screen that says exactly what that trades away. And the inbox learned to carry it: the list now paints instantly and stays quick at half a million imported messages, still without the server being able to read one of them.
read the session →keymail becomes something other sites can build on. A website can now offer “Sign in with keymail” — you approve it on a consent screen that says exactly what the app can and cannot do — and an approved app or newsletter can write to you without ever reading your mail, every message still sealed to your key alone. Their mail lands in two new tabs, Apps and Newsletters, so your inbox stays yours, and one click in Settings revokes an app for good. The developer docs are public at keymail.dev/docs/api.
read the session →Outbound email switches on for keymail.dev: reply to any ordinary address and it arrives as plain email, while your own copy stays sealed to your key. And every mailbox now carries its own sending reputation — one person's bad day can't dent anyone else's deliverability.
read the session →Type, and your whole mailbox answers — results appear as you type, across every folder, even half a million imported messages. The index is built and kept in your browser, so the server that stores your mail still can't read a word of it: search works precisely where the mail is unsealed, on your own device, and nowhere else.
read the session →Replies to the old world now carry full authentication — the checks every big provider runs (SPF, DKIM, DMARC) all pass, and all agree the mail is keymail.dev's. The difference you feel: replies stop landing in spam folders.
read the session →The consent screen grew up: when a website asks to use your keymail, you choose which inbox to connect, and the Allow button itself runs your passkey — so a stranger at your unlocked laptop can't approve an app as you. Presence, not just a signed-in browser.
read the session →Import stops being a one-off. Flip one switch and new Gmail keeps flowing into your keymail box every few minutes, each message sealed to your key before it's stored. Sync is the one exception to “the server keeps nothing” — while it's on, an encrypted read-only Google credential stays on the server — so the switch says exactly that, and one click here or at Google takes it back. Receipts survive the trip whole: PDF attachments arrive byte-for-byte, and orders and bookings keep the machine-readable details your apps can act on.
read the session →