Click here to open Mailvelope in the Chrome app store. Then click Install. When the confirmation prompt appears, click Install.
After installation, a lock icon is displayed in the main Google Chrome toolbar (to the right of the address bar). Click it to open the Mailvelope main menu.
Click on the icon below to download Mailvelope from download.mailvelope.com. Choose Allow and Install in the Firefox dialogs to install Mailvelope as an add-on in your browser.
OpenPGP and therefore Mailvelope use public-key encryption, which means a key is split into two parts: public and private keys with different purposes:
In order to send encrypted emails to a peer, you must have the public key of the recipient. Therefore, before secure communication can happen between two people, they must exchange their public keys with each other. There are multiple ways that public keys can be distributed:
Public and private keys, as well as encrypted messages in OpenPGP, are encoded in a defined text formats that allow them to be exchanged or stored as text files.
For example, a public key would look like this:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: Mailvelope v1.1.0
-----END PGP PUBLIC KEY BLOCK-----
Click on Mailvelope's lock icon in the toolbar to open the main menu. Click Options to navigate to Key Management, where all the keys are stored:
To use Mailvelope, at least one key pair (consisting of a public and private key) must be available. You can either generate a new key pair as explained in this section, or import an existing key pair as described below.
Click Generate Key to open the key generation dialog. Fill out the boxes and assign a key password. Make sure you never lose this password. If it is lost, the password cannot be recovered and the key can no longer be used.
Enter all the necessary information. Click Submit to start generating a key. Afterwards, you can see the result in the key list by selecting Display Keys.
Existing keys can be imported from other applications. In the option menu, click Key Management and then Import Key.
With this function you can select a file on your hard drive with keys, which will be imported into Mailvelope.
Paste any keys into the text box in text format as shown above in the Message Formats section. Clicking on Import will extract all keys from the text and transfer them into the local keyring.
Search for PGP keys on public key servers by entering email address or name of key owner.
Search results will be displayed on the key server website in a new tab.
After clicking on the displayed
keyID, the key text will be shown and Mailvelope is able to detect the key.
With another click on the key symbol the key is imported into Mailvelope.
Key export functionality is used to export keys in text format. We can use this function to publish public keys or to make a backup of a public-private key pair in a secure place.
For this purpose, click the Export button on the "Display Keys" option page. The keys are saved in asc format. This format can be read by all common PGP implementations.
Hover over the relevant key pair and click the information icon (i). Switch to the Export tab and select the key(s). Then click Download.
In the Display Keys menu, you can view more information about each key using the information icon (i). You can define your key as the primary key here. The primary key is always used unless another key is explicitly selected.
Mailvelope extends the user interface of webmail sevices with controls that can be used for encryption and decryption of emails.
Depending on the webmail provider, Mailvelope offers two levels of integration:
In the following we describe the second variant and explain usage of the Mailvelope components for message encryption and decryption.
Email messages are created and encrypted in an external editor.
The Compose button is displayed in all email composing areas of the webmail provider and will launch Mailvelope's external editor.
Clicking on the Compose button will open a new popup with a separate editor. This ensures that the email creation and encryption process is completely isolated from the webmail provider.
The email can now be composed. You can choose the recipients, or more specifically the people who should be allowed to decrypt the message, by adding the email address to the upper input field in the dialog. Like in other email clients you can also search in this field for recipients by name. For each recipient, there has to be a public key available in Mailvelope's keyring. If you enter an unknown email address, Mailvelope will automatically search on the Mailvelope key server (keys.mailvelope.com) for PGP keys and import found keys without further action required. Alternatively you can also import keys manually as described in Importing keys.
Next, click the Encrypt button to encrypt the message and transfer the result back to the webmail client.
With the Options button in the Mailvelope editor you can access the option to sign the message.
After clicking Encrypt with the sign option active the message will be first signed with the selected private key and then encrypted. The link Sign all messages with primary key will naviate to the Mailvelope settings where you can choose to always have the signing option active and the primary key pre-selected as your signing key.
Now the encrypted message can be sent as usual.
Whenever Mailvelope detects an encrypted message in your mail client, it marks it with an icon (closed envelope). Click in this area to start decryption.
Next, enter your key password and click OK.
Mailvelope tries to find the private key that is required to decrypt the message. If the correct key is found in the keyring, the corresponding User and Key ID are displayed in the password dialog.
After the key is unlocked with the password, the message is decrypted and directly shown in the marked area.
If an encrypted message contains a signature, Mailvelope will verify the signature and show the result with a label in the upper right corner of the decrypted message. A click on the Signed digitally label will open up a dialog showing the verfication result and details regarding the signature.
Click on Mailvelope's lock icon in the toolbar to open the main menu. Click Options and choose File Encryption from the top navigation.
With the file encryption feature of Mailvelope you can encrypt files on your hard drive according to the PGP standard. In the same way as email encryption, the files will be encrypted with the public key of the receiver.
The file encryption function can also be used to encrypt and decrypt email attachments.
Background: email providers that directly integrate Mailvelope into their email application will support encrypted email attachments automatically. For email providers like Gmail™, Yahoo™ or Outlook.com™ there are restrictions in the Mailvelope editor and encrypted attachments are not directly supported. The file encryption outlined here offers an alternative in this case, as it is possible to encrypt email attachments manually instead.
In a first step files on the hard drive will be selected for encryption with + Add.
Click on Next and choose the persons you want to encrypt the files for.
After clicking Encrypt the files are encrypted for the selected recipients.
Select the encrypted
.asc files to save them to your downloads folder or choose Save all.
The steps to decrypt files are similar to the encryption process. First choose Decryption in the left menu. In a next step
.asc files on the hard drive will be selected for decryption with + Add. The decrypted files are displayed after you have entered your private key password.
Mailvelope comes preconfigured to work with the following webmail services:
Using this general approach, it can be configured to work with any webmail provider. You can make these settings in the Preferences section of the Options view.
The watch list defines a set of websites that are enhanced with the functionality provided by Mailvelope.
By default, Mailvelope is active for all sites on the watch list. To deactivate a site, click Edit in the corresponding row and change the Active value. Confirm with OK.
Load the website you want to add to the watch list in a browser tab (the active tab). Click the lock icon in the browser extension toolbar to open the main menu. Click Add page. The browser will open a new tab with Mailvelope's Options page and will add the website to the watch list. Reload the website to activate Mailvelope.
Click one of the entries to make additional settings:
Active: You can deactivate the entry without deleting it here.
Site: The name of the entry in the watch list.
Status/Domain Template/API: Allow individual pages to or prohibit individual pages from using the Mailvelope API.
Advanced: when expanding a row in the watch list, we see the frames that will be scanned for encrypted emails and email composing areas. If we can identify irrelevant frames (e.g. from ads), we can set the Scan value to false and minimize the scanning effort.
Load the website you want to remove from the watch list in a browser tab (the active tab). Click on the lock icon in the browser extension toolbar to open the main menu. Select Remove page. The browser will open a new tab with Mailvelope's Options page. After confirmation, the website is removed from the list.
Mailvelope offers end-to-end encryption, which means that the application must ensure that the user's confidential data can never leave the computer.
Mailvelope's user interface consists of a set of isolated elements floating on top of the webmail provider's UI elements. This tight integration improves usability, but also requires measures to prevent any data leakage.
Mailvelope's security goals are as follows. All data must be safe even if:
In this section, we look at security from an end user perspective. Further information is also available in the security section of the FAQ. The relevant settings can be found in the following dialog.
Click the Mailvelope icon , then Options from the menu, then the Options tab and Security to open the security settings.
Mailvelope can cache passwords for private keys in the local memory. You can activate the cache in the security settings or with the password dialog. Passwords have a certain lifetime, which can be adjusted in the settings, and are always deleted when you close the browser window.
Mailvelope input fields are identified with a background of lock icons. In order to detect potential fakes more easily, you can set how the background should look here, as well as adjusting the angle, scaling and color of the icons.
Two different modes are available for displaying the encrypted messages:
This offers the best usability. The encrypted messages are displayed inside an isolated sandbox that is not accessible by the webmail provider.
The watermark shown in the background of the decrypted message has the same purpose as the security token concept: You can clearly identify that the displayed message is the one decrypted by Mailvelope.
The decrypted message will be shown in a new browser window.
Click the lock icon in the Last activities section to view the security log. All events related to Mailvelope are logged here. If necessary, check the log for suspicious activities. Click More to go to a more detailed view