Frequently asked questions

No, and you cannot make one. Your Nostr key pair is the account: the public key identifies you and the secret key proves it is you. Nobody issues it, nobody can suspend it and nobody can reset it — including us.

You lose the account. There is no recovery process, and that is not an oversight: a recovery process would mean somebody else can get into your mail. Export your key and keep it somewhere safe, or use a remote signer that holds it for you.

Yes, through a bridge — uid.ovh by default, and you can change it. Be clear about the trade-off: that mail is not end-to-end encrypted. The bridge converts your message into an ordinary email and can read it on the way through.

Mail between two Nostr users is encrypted end to end with NIP-17 gift wrap; relays see an envelope, not the contents. Attachments and large messages go to Blossom servers already encrypted. What is not hidden: your public key, your IP address as seen by relays, when you send and receive, and — for now — your read state and folder names.

Marking mail as read, starred or archived publishes a NIP-32 label event, and those are currently unencrypted. It means someone who knows the id of a mail they sent you can tell when you read it. Encrypting labels is on the roadmap; until it ships, treat folder names as public and we will keep saying so.

No. Herkos ships with sensible defaults — 4 relays, 3 DM relays, 7 Blossom servers and 1 bridge — all of them operated by other people, and all of them editable in Settings. We run no server of our own, which is also why we cannot read anything.

Yes, at app.herkos.app — and we say the same thing there that we say here: a browser is the weakest place to keep a key. An installed app hands your secret key to the system keychain; a web page keeps it in the browser's own storage and runs it through JavaScript on every signature, where an extension with access to every site, an XSS bug or a tampered deployment could read it. A signed binary is verified once, at install time; a web page serves fresh code on every visit. So: sign in with a remote signer (a NIP-46 bunker, Amber) and the key never reaches the browser, or use the web with an identity you can afford to lose.

None. No analytics, no crash reporting, no telemetry, and this website sets no cookies and loads nothing from third parties — the font is served from our own domain rather than from Google. Notifications and “send later” do involve third-party services; both are off until you turn them on and the privacy policy names them.

Yes, and free as in both senses: no price and MIT licensed. There is no paid tier and no plan to add one for the mail client. If Herkos ever operates storage for the Drive, that would be a paid service and we would say so plainly.

They are excellent, and they are companies that hold your account. If they are compelled, or breached, or they close, your address goes with them. Herkos has no account to hold and no server to raid — the flip side being that nobody can help you if you lose your key.

A small independent project. Herkos is a fork of Nostr Mail Client by nogringo, also MIT licensed, and it would not exist without that work.