Herkos Mail
Private mail between Nostr users, end-to-end encrypted, and ordinary email through a bridge.
In the browser your key lives in the browser: sign in there with a remote signer, or read the security page first.
Available with the first release
What it is
Herkos Mail is a free, open-source mail client built on Nostr. Your Nostr key is your account. Messages between Nostr users are end-to-end encrypted by default, using NIP-17 gift wrap, and you can still write to ordinary email addresses through a bridge.
Why Herkos is different
It runs on your computer, not in a tab. Herkos is a native app for Windows, Android and Linux — with a web version as well, not instead. System notifications, offline access, Windows Hello and biometrics, and a key that never has to live inside a browser tab. For something whose whole promise is that the key is yours, where it runs is part of the promise.
There is no account to close. We don't sell you an address on our servers. There is no Herkos server: the relays, the bridge and the storage are yours to choose, and none of the defaults is run by us. Your address is your key, so nobody — us included — can take it away, lock it, or shut it down with your mail inside.
End-to-end encrypted between Nostr users. Custom folders that sync across your devices and survive a reinstall. Multiple identities from one key. Attachments on Blossom servers.
Calendar planned
A private agenda where every event is encrypted before it reaches a relay. Your calendar says more about you than your inbox does, so encryption is not optional.
Notes planned
Private notes in Markdown, encrypted to your key before they reach a relay. Edit offline on two devices and you keep both versions: neither overwrites the other.
Drive planned
Encrypted files on Blossom servers with a Nostr-signed index, replicated across several servers so that no single operator can lose your data.
Bunker planned
A signer (NIP-46) that keeps your key and signs for the other Herkos apps, so your nsec lives in one place instead of in every app.
How signing in works
There is nothing to register. You sign in with your nsec, or — better —
with a remote signer (a NIP-46 “bunker”, by QR or nostrconnect://),
in which case your secret key never touches the device at all. You can export your key
whenever you want, because it is yours.
Mail between Nostr users is end-to-end encrypted and nobody in between — us included — can read it. Mail to a Gmail or Outlook address is not: a bridge converts it and can see the content. Read state and folder names are, for now, public metadata on your relays. We would rather write that down than have you find out later — the privacy policy and the security page say exactly who can see what.
The web version handles your key inside the browser, which is a worse place for it than a native app. If you use it, prefer a remote signer — a NIP-46 bunker — so the key never touches the page.
Built to be checked
All of it is open source under the MIT licence: one Flutter codebase for mobile, desktop and web, fully translated into 17 languages. The defaults — 4 relays, 3 DM relays, 7 Blossom servers and 1 bridge — are all editable, and none of them is run by us.