Your public key
Think of it as an open padlock with your name on it. Epistle hands copies to anyone who writes to you, so they can lock letters that only you can open. Sharing it is safe: it can lock, never unlock.
In one picture
Only the person you wrote to can open it.
An encrypted letter is locked on your device before it leaves, and unlocked on theirs. Everything in between, Epistle included, only ever holds the locked copy.
S Sarah writes
Sunday lunch
Lunch at ours at one? Bring the little ones.
Sealed with James’s key
? What the servers see
-----BEGIN PGP MESSAGE----- wcFMA8x2kH9lQe0pARAAq7Zt 3Vf0+Kc1yWm8LrP4hNbX0uEo T9sJd2Gq6vAa5RkMz/Yw1Bf+ iHc7nUeL0pQsXo4KvD9tF2mZ -----END PGP MESSAGE-----
Scrambled. Useless to anyone without the key.
J James reads
Sunday lunch
Lunch at ours at one? Bring the little ones.
Opened by his key, automatically
The tutorial
Encrypted email in 3 easy steps.
No key files, no passphrases, no “import your public key”. Epistle does the encryption for you, every time, without asking. All you do is glance for the gold.
-
Sign up. Your key is made for you.
The first time you sign in, Epistle makes your encryption key by itself. There is no passphrase to choose and nothing to download.
Your key is locked with your Epistle password, so every time you sign in, it unlocks too. You won’t notice it’s there.
What you do: sign up, like any email.
Your keys
sarah@epistle.emailCurve25519 · made when you first signed inPrimary- Key made for you
- Unlocked when you sign in
- Shared with people who write to you
-
Write. Look for the gold seal.
Type an address as usual. If that person can receive encrypted mail, a small gold wax seal with a cross appears on their name. That seal is all you need to look for: it means your letter is end-to-end encrypted for them.
Letters between Epistle users are always encrypted. People on other services who use PGP get the seal too, when their key can be found. Everyone else simply gets a normal email: you never have to choose.
What you do: write and press Send.
To James Carter anna@posteo.deSubjectSunday lunchLunch at ours at one? Bring the little ones.
Sarah
Send -
Read. It just opens.
Encrypted letters open like any other. Under the subject, a badge tells you how the letter was protected. Tap it for a plain-English explanation.
A green Signed badge means the letter really came from that person and nobody changed it on the way.
What you do: nothing. Just read.
Re: Sunday lunch
JJames Carter <james@epistle.email>
End-to-end encrypted Signed by JamesWe’ll be there. I’ll bring the bread.
James
End-to-end encrypted. It was locked before it left the sender, with the keys of the people it was written to. Only they can open it: not Epistle, not the mail servers it went through, nobody else.
That’s it. See gold, it’s sealed.
Keys, without the jargon
A padlock you hand out. A key you keep.
Your private key
The only key that opens those padlocks. It’s stored locked with your password and unlocked when you sign in. You never have to see it, copy it or carry it around.
Straight answers
What’s protected, and what isn’t.
Encryption only helps if you know where it stops. Here is all of it, plainly.
Letters between Epistle usersEnd-to-end encrypted and signed, every time, automatically. The words and the attachments.
Letters to people who use PGP elsewhereThunderbird and every other mail app that speaks PGP: end-to-end encrypted when their key can be found. You’ll see the gold wax seal on their name.
Your draftsSaved locked with your own key while you’re still writing.
DangerLetters to Gmail and OutlookGoogle and Microsoft don’t do PGP, so a letter to an @gmail.com, @outlook.com or @hotmail.com address leaves without a seal and sits in their data centres in plain, readable form. These are two of the biggest advertising and data businesses on earth. Google read Gmail users’ letters for thirteen years to pick their adverts. Outlook’s free inbox still puts adverts between your letters. Your words become their resource.No gold wax seal on a name? Then Google or Microsoft can read it. Keep private things out of it, or invite them to Epistle.
Letters that arrive unencryptedMost of the world’s email arrives unencrypted. Turn on Encrypt mail when it arrives and your mailbox locks it with your key as it’s stored, together with your Sent letters. It’s off unless you switch it on, because searching inside those letters stops working.
Subject line, sender, recipients and dateNot encrypted: mail servers need them to deliver your letter, and your inbox uses them to list and search it. Keep secrets in the letter, not in the subject.
Optional, for later
Want to go further?
None of this is needed. It’s all in Settings › Encryption in the webmail, when you’re curious.
Encrypt mail when it arrives
One switch, under “Your mailbox”. Letters that come in unencrypted, and the ones you send, are locked with your key as they’re stored.
Back up your key
Save your key to a file with a password of your choosing. Handy if you ever want it in another mail app, or for peace of mind.
Publish your key
Put your public key on keys.openpgp.org, so people on other mail apps can find it by your address and write to you encrypted.
Questions
The ones people actually ask.
Do I have to set anything up?
No. Your key is made the first time you sign in, and encrypting for everyone who has a key is on from the start. The three steps above are the whole tutorial.
What is PGP, in one sentence?
An open, decades-old standard for locking an email so only the person it’s for can open it, and signing it so they know it’s really from you. Nobody owns it: any mail app on any server can use it, so Epistle users can write encrypted to anyone else who does. One of the most popular email services built on PGP is Proton Mail, so you can always write to Proton users encrypted, automatically.
The person I’m writing to doesn’t use Epistle. Does it still work?
Yes. If they use PGP and their key can be found, they get an encrypted letter and you’ll see the gold wax seal. If they don’t, they get an ordinary email that reads like any other. Nobody is ever sent something they can’t open.
Does it work in the mobile app?
Yes. The app uses the same keys as the webmail: the same gold wax seals when you write, and encrypted letters open by themselves. Backing up, importing and publishing keys live in the webmail.
What if I forget my password?
Your key is locked with your password. If your password is reset, your old encrypted letters stay locked until you type the old password once, under Settings › Encryption › Reactivate. So keep your password somewhere safe, and make a backup of your key if your letters matter to you.
Can Epistle read my mail?
We don’t, and with no adverts to sell there’s nothing to gain from it. Letters that reach you end-to-end encrypted stay locked in your mailbox, and your private key is kept only in locked form, opened by your password when you sign in.
What does the wax seal on Send mean?
It’s just how Epistle sends a letter: rolled, tied and sealed with a cross. It shows on every letter. The small gold wax seal on a name or a letter is what tells you it’s encrypted.
Your letters, sealed.
The grace of our Lord Jesus Christ be with you all. Amen.