# Mailvelope for OpenPGP Webmail Encryption

> Mailvelope is a Chrome and Firefox extension for OpenPGP-based secure email in Webmail. It suits users who need browser-side OpenPGP workflows, but provider configuration and key handling need verification before adoption.

**mailvelope/mailvelope** — Browser extension for OpenPGP encryption with Webmail

- Repository: https://github.com/mailvelope/mailvelope
- Stars: 1,847 · Forks: 220
- Language: JavaScript
- License: AGPL-3.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/mailvelope-mailvelope

## Mailvelope's Browser-Based OpenPGP Scope

Mailvelope addresses a specific problem: adding OpenPGP encryption and decryption to email composed through a Webmail interface. It is a browser extension for Google Chrome and Firefox, and the README says that it can be configured to work with an arbitrary Webmail provider. Its intended users are people who already depend on browser-based email but need OpenPGP message handling without making a separate desktop mail client the central part of their workflow.

The README limits the product's role to secure email communication based on the OpenPGP standard. It does not present Mailvelope as a general encrypted file utility, a command-line key manager, or a server-side mail encryption service. The repository's `package.json` lists `openpgp` version `5.11.3` as a dependency, while the README names OpenPGP.js as the OpenPGP implementation used by both the Chrome extension and the Firefox add-on. This establishes the main mechanism: OpenPGP operations are integrated into a browser extension rather than delegated to a separate mail application.

That approach has a clear benefit and a matching constraint. It keeps the OpenPGP workflow near the Webmail page, but it also makes browser support and Webmail integration part of the adoption decision. The README says that arbitrary Webmail providers can be supported through configuration, but it does not include a compatibility matrix, setup instructions for individual providers, or a statement about which providers receive continuing compatibility work.

## Extension Build Layout And Client API Boundary

Based on the repository layout, Mailvelope is a multi-part JavaScript extension rather than a single script. Application source is under `src/`, build configuration is under `config/`, interface text is under `locales/`, and tests are represented by Jest configuration files at the repository root. `Gruntfile.js` drives the documented build tasks. The `dist/` directory also has a role in producing installable packages, which supports the separation between development source and browser-distributed artifacts.

The README describes separate build outputs for the two supported browser targets. A Chrome build becomes `dist/mailvelope.chrome.zip`, while a Firefox build becomes `dist/mailvelope.firefox.zip`. This distinction matters because an extension package is not interchangeable merely because both targets implement OpenPGP operations. Reviewers should inspect the generated archive for the intended browser instead of assuming that a successful JavaScript build proves the package is ready for distribution.

Mailvelope also publishes a separate client API. The README links to GitHub Pages for current documentation and states that the documentation version corresponds to the `master` branch. A demo page with unit tests is available at `https://demo.mailvelope.com`. The `package.json` includes a `docs` script that uses JSDoc with `doc/client-api/Readme.md`, confirming that API documentation is part of the repository workflow. However, the README does not enumerate API methods, key lifecycle rules, event names, or error contracts. Code that depends on exact client API behavior should be checked against the generated documentation rather than inferred from the extension UI.

## Installing Mailvelope And Producing Browser Packages

The simplest documented installation route is through an official browser store. The README links to the Chrome Web Store entry for Mailvelope and an addons.mozilla.org listing for Firefox. It also directs users who want downloadable build packages to the repository's releases section. The README does not document a Linux, macOS, or Windows installer because the distributed artifact is a browser extension.

For development, the README requires `grunt-cli`, then instructs contributors to clone the repository and build its sources. This command sequence installs the build CLI globally, retrieves the source tree, installs locked npm dependencies, and runs the production build:

```bash
npm install -g grunt-cli
git clone https://github.com/mailvelope/mailvelope.git
cd mailvelope
npm ci && grunt prod
```

A successful `grunt prod` completes the general production build, but it does not by itself identify the final browser-specific archive. The repository version in `package.json` is `6.3.0`, and the README's linked release information identifies `v6.3.0` as the current release. Commands must run from the cloned `mailvelope` directory.

After the production build, the browser-specific package is created with the appropriate Grunt task. Chrome uses `dist-cr`:

```bash
grunt dist-cr
```

The README says the Chrome extension will then be in `dist/mailvelope.chrome.zip`. Firefox uses `dist-ff`:

```bash
grunt dist-ff
```

The resulting Firefox package will be in `dist/mailvelope.firefox.zip`. Reviewers should check that this expected file exists and that its target browser matches the intended deployment. The README does not document signing credentials, store publication steps, provider setup, or key creation commands, so this tutorial cannot safely extend into those operations.

## Development Testing And OpenPGP Backend Constraints

Mailvelope provides several documented test entry points through `package.json`. The default test command runs Jest. Unit tests can be isolated with `npm run test:unit`, while integration tests first build their test bundle with `npm run build:integration`. Running `npm run test:all` performs that integration build and then runs Jest with its configured projects.

These commands are relevant because the project includes both unit and integration test configurations. They also reveal a practical constraint: the test workflow is more than starting the extension. Integration coverage requires a Webpack-generated test bundle, and browser development has separate build and reload steps.

For Firefox extension development, the README provides a direct `web-ext` command:

```bash
npx web-ext run --source-dir=./build/firefox
```

This command starts the Firefox extension from `./build/firefox`. The README states that it can be reloaded after changes and recommends running `grunt watch` in another terminal. The watch command is:

```bash
grunt watch
```

The repository exposes Jest watch, coverage, debug, and one-process execution modes through its npm scripts, but these are development controls rather than user-facing encryption features. The backend itself is fixed to OpenPGP.js according to the README. Mailvelope's value therefore depends on that JavaScript implementation and the extension's browser integration. The README does not document support for S/MIME, non-OpenPGP key formats, hardware security keys, or operation outside Chrome and Firefox, so none of those should be treated as adoption guarantees.

## Mailvelope Versus Standalone Desktop OpenPGP Workflows

The closest architectural alternative is a standalone OpenPGP-capable desktop email client. The approaches differ in where cryptography and message composition meet. Mailvelope runs OpenPGP operations inside a browser extension and integrates them with Webmail, as stated in the README and supported by its Chrome and Firefox packaging tasks. A desktop client instead handles mail and OpenPGP workflows as part of a separate mail application. The repository does not document a competitor or benchmark against any particular desktop client, so the useful comparison is architectural rather than a claim that one implementation is faster or more reliable.

Mailvelope is the more direct option when the user's mail workflow must remain in a browser and when provider integration can be configured. The browser extension format also gives the project explicit Chrome and Firefox build outputs. Its tradeoff is that adoption depends on extension installation, browser compatibility, and the quality of the Webmail configuration.

A standalone client is the more appropriate alternative when the required Webmail integration cannot be configured or when browser-side operation is not acceptable. Mailvelope's README does not provide a feature-by-feature account of key storage, smartcard support, signing policies, attachment handling, or provider-specific failure behavior. Those are real evaluation boundaries because a shared OpenPGP standard does not guarantee identical interfaces, key workflows, or failure handling across tools.

## Maintenance, Upgrades, And AGPL-3.0 Obligations

The repository is not archived, and its last push was on 2026-07-28. The release history includes `v6.3.0` on 2026-06-11, `v6.2.1` on 2026-01-16, and `v6.2.0` on 2025-10-18. These dates indicate recent repository and release activity. They do not, by themselves, establish that every Webmail provider configuration is actively maintained.

An upgrade can touch several parts of the project rather than only extension UI code. The project uses OpenPGP.js, React, email parsing and MIME building dependencies, browser packaging tasks, generated documentation, and test bundles. The dependency versions are locked through `package-lock.json`, and the README uses `npm ci`, which installs from that lock file. Maintainers evaluating an upgrade should therefore compare package and lock-file changes, rebuild both relevant browser targets, and run the documented Jest suites.

The source is governed by the GNU Affero General Public License under `AGPL-3.0`, and the README points to the repository `LICENSE` file. That license is material for organizations considering modification or network use because it contains source-offer, licensing, and notice conditions. This is not legal advice. A distributor or integrator should read the actual `LICENSE` file and assess its obligations for the intended deployment. The repository's inclusion of `doc/` and API documentation does not replace license review for derived or modified software.

## Conclusion

Mailvelope fits individuals or integrators that want OpenPGP operations embedded in Chrome or Firefox Webmail and are prepared to validate provider-specific behavior. It is a weaker choice for teams requiring a documented server-side deployment path or automatic support for every Webmail provider. Before adoption, verify the intended provider configuration, generate and inspect the relevant Chrome or Firefox package, and confirm that the current client API documentation covers the required workflow.

## FAQ

### Which browsers support Mailvelope?

Mailvelope is documented as a browser extension for Google Chrome and Firefox. The build process produces separate Chrome and Firefox packages.

### Which OpenPGP implementation does Mailvelope use?

The README states that Mailvelope uses OpenPGP.js for both the Chrome extension and the Firefox add-on. The repository's `package.json` lists `openpgp` version `5.11.3`.

### How do I build Mailvelope from source?

Install `grunt-cli`, clone the repository, run `npm ci && grunt prod`, and then use either `grunt dist-cr` or `grunt dist-ff`. The README locates the resulting archives under `dist/`.

## Sources

- [Issues](https://github.com/mailvelope/mailvelope/issues)
- [License: AGPL-3.0](https://github.com/mailvelope/mailvelope/blob/master/LICENSE)
- [mailvelope/mailvelope on GitHub](https://github.com/mailvelope/mailvelope)
- [README](https://github.com/mailvelope/mailvelope/blob/master/README.md)
- [Releases](https://github.com/mailvelope/mailvelope/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/mailvelope-mailvelope