Docs

End-to-end encryption

Every message is sealed to your key before Orbit stores it, and opened in your browser. Use the relay Orbit runs, or host your own; whatever your choice, no Orbit server ever stores mail it can read. The one readable moment is the instant a receiving relay seals a new message as it arrives, on Orbit's machine or yours, described below. The key is derived from your Orbit password when you sign in, and no server, ours included, ever sees it.

How it works

Three parties: the relay that speaks SMTP, Orbit Mail that stores and shows your mail, and your browser. Only the first and the last ever see a message readable.

Your key
When you sign in, Mission Control's sign-in page turns your Orbit password into keys in the browser, before anything is sent. One of them is handed to Orbit Mail in a part of the address no server receives, and your browser derives your encryption key pair from it. The private half stays in that browser; only the public half is registered with Orbit Mail. Sign in on another device and it derives the same pair. Orbit Chat and Orbit Pass use the same identity.
Receiving
A message arrives at the relay over SMTP. The relay asks Orbit Mail for the recipient's public key, seals the whole message to it, and only then stores it in its queue and posts it on. The plaintext never leaves the relay, and for a recipient whose key already exists it never rests on disk. (The one exception is mail for someone who has not signed in yet, so no key exists to seal it to; see below.) Orbit Mail stores the ciphertext and files the message by its headers.
Reading
Orbit Mail shows the message as locked. Your browser fetches the ciphertext and opens it with your private key, on your screen. Nothing is pasted or typed; signing in is what unlocked the browser.
Sending
What you write is sealed in the browser to your own key, so your Sent copy opens later, and to the relay's key. The relay opens its copy, assembles the email and hands it to the internet. Orbit Mail holds the ciphertext and the address lines, nothing more.

Our relay, or yours

The relay is open source and the encryption is the same either way.

  • Use Orbit's relay. Nothing to set up. Point your domain at it and your mail is sealed to your key the moment it arrives.
  • Run your own. One command on Ubuntu or Debian, with a relay key for your account from Settings, Encryption in Orbit Mail. A relay running with your key delivers to your mailboxes only, and the moment a message is readable happens on a machine you control. See self-hosting the relay.

What is protected, and what is not

Be clear-eyed about the boundary. Orbit cannot read the message body, its HTML, or any attachment, in either direction, and holds no key that could. Orbit can see the sender, the recipients, the subject, the date, the size and the headers that thread replies together. Those are the parts every mail server on the internet sees as a message passes through; they are what makes the inbox list, threading and search work without the key.

This is the same line PGP and S/MIME draw. The relay that receives a message sees it for the instant between accepting it and sealing it, as any receiving mail server does; with our relay that instant is on Orbit's machine, with yours it is on yours. Mail that your correspondents send to other providers, and mail they receive from you, is of course readable at their end as it always was.

Day to day

  • A locked browser. Signing in by passkey, or in a browser that never saw your password, leaves the browser without your key. Mail shows as locked; Settings, Encryption offers to sign you in again with your password, which unlocks it. The password is typed only on the sign-in page.
  • Several devices. Each browser derives the same key at sign-in. Nothing to copy between them.
  • Changing your password gives you a new key. New mail is sealed to it once you register it; mail sealed to the old key opens after you enter the previous password once, in the browser only.
  • Search covers senders, recipients and subjects. The server cannot index what it cannot read.
  • Junk filtering runs on headers, authentication results and your blocked and safe lists, but not on body content.
  • Drafts are not saved, because a draft would reach the server readable. Send the message or discard it.
  • Before your first sign-in mail for you waits at the relay (for up to three days) until your key exists; it is sealed and delivered the moment you sign in.

If you lose your password

A password reset gives you a new key. Mail sealed to the old key can only be opened by someone who knows the old password; if nobody does, it cannot be recovered by anyone, including Orbit. That is the point of the design.

The details

Your identity is an ECDH P-256 key pair derived from the vault key with HKDF-SHA256, the same identity Orbit Chat uses. Each message is encrypted with a fresh random key under AES-256-GCM, with a 96-bit nonce, a 128-bit authentication tag and a fixed associated-data string naming the format. That key is wrapped once per reader: an ephemeral P-256 agreement with the reader's public key, HKDF-SHA256, then AES-256-GCM with the reader's key id as associated data. A key id is the first twelve hex characters of the public key's SHA-256 and reveals nothing secret. The browser uses the WebCrypto API with the same parameters, so there is no custom cryptography on either side. The relay's implementation is in the open source repository at https://github.com/Orbit-AI-LLC/Orbit-SMTP-Relay.