Private Email for
Security-Conscious Users

Fose uses military-grade AES-256 encryption for all emails, with true end-to-end encryption ensuring that only you and your intended recipients can read the messages. Our zero-knowledge architecture means even we can't access your data.

To maintain true end-to-end encryption and ensure the highest level of security, Fose requires the use of our dedicated email client. This allows us to implement advanced security features and guarantee that your communications remain completely private.

Our client is built from the ground up with security in mind. It features a modern interface, real-time encryption, secure attachments, and advanced privacy features like self-destructing messages and verification of recipient identity.

Due to our zero-knowledge encryption, we cannot reset your password. However, we provide a secure recovery key system during account setup that you can use to regain access to your account. Keep this recovery key in a safe place.

Your encrypted data is stored in secure data centers across multiple jurisdictions for redundancy. Our primary operations are based in Belize, known for its strong privacy laws, ensuring your data remains protected from government surveillance.

While you can't directly connect other email accounts to Fose, we provide a secure import tool that allows you to migrate your important emails into your Fose account. All imported emails will be automatically encrypted using our secure system.

Fose employs X25519 for key exchange and key agreement, combined with Ed25519 for digital signatures. For the initial key exchange, we use forward-secret ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) to ensure perfect forward secrecy, meaning that even if a private key is compromised in the future, past messages cannot be decrypted.

Attachments are encrypted client-side using AES-256-GCM before upload. Large files are split into encrypted chunks and use streaming encryption to handle files of any size efficiently. Each chunk is individually encrypted and authenticated, ensuring the security and integrity of your attachments.

Fose implements certificate pinning, DANE (DNS-based Authentication of Named Entities), and strict transport security (HSTS). We also use subresource integrity checks and maintain a public key transparency log to prevent unauthorized certificate authorities from issuing rogue certificates for our domain.

Yes, Fose fully supports FIDO2/WebAuthn security keys like YubiKey and Google Titan. You can use these for both account authentication and email signing. We recommend using hardware security keys as they provide the strongest protection against phishing and account takeover attempts.

All encryption and decryption occurs locally in your browser using WebCrypto API. Your private keys never leave your device and are protected using memory encryption. The server only sees encrypted blobs and never has access to plaintext data or encryption keys. For added security, we use key splitting and secure enclaves for key storage.

We minimize metadata collection and encrypt all available metadata fields including subject lines, timestamps, and recipient information. Our system uses padding and traffic obfuscation to prevent timing analysis. Additionally, we implement cover traffic and batch processing to make traffic analysis more difficult.