Webmail
Forward Email Webmail privacy rating
Our pick
Hosted webmail for Forward Email accounts, with mail, calendar and contacts, built-in OpenPGP and optional encryption of locally cached data. It shares one source-available codebase with the Forward Email desktop and mobile apps.
Summary
Forward Email Webmail scores 74 out of 100 (grade C) on the webmail criteria. It meets 6 of 13 criteria: open source, no ads or data sales, independent audit, tells users about requests, OpenPGP support and connects directly. It partly meets no trackers or telemetry, transparency report, TLS configuration, security headers, blocks remote content and self-hostable. It does not meet works with any provider. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade B+.
Score 74 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3 Source-available
Is all the source code needed to run the product public?
All code is public. The webmail app is under the source-available Business Source License 1.1, which becomes MPL-2.0 four years after each release, and the Forward Email service behind it is published under MPL-2.0 and BUSL-1.1.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party analytics in the webmail. The privacy policy describes first-party anonymized analytics of page views and service usage, including API use, that is on by default.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans. No ads, and user data is not shared with third parties.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Cure53 audited the webmail source code, including its client-side logic, together with the Forward Email service.
-
Partial
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
The technical whitepaper (section 9.3) publishes the government request policy and commits to transparency reports with request counts. A report with counts is not published yet.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Users are notified of requests when legally allowed, with notice after disclosure when advance notice is prohibited.
-
Yes
OpenPGP support Weight 2 of 3
Can the app encrypt and sign mail with OpenPGP, built in or through an official add-on?
OpenPGP encryption and signing are built in.
-
Yes
Connects directly Weight 3 of 3
Does the app connect directly to your mail server, without passing mail or passwords through the vendor's servers?
The browser connects directly to the Forward Email API, which is the mail server, with no separate sync service.
-
Partial
Blocks remote content Weight 2 of 3
Are remote images and tracking pixels blocked by default?
Tracking pixels are blocked by default, but other remote images load unless blocking is turned on in settings.
-
No
Works with any provider Weight 1 of 3
Does the app work with any standard IMAP and SMTP provider?
Works only with Forward Email accounts. The maintainers state that a future version is planned to support any IMAP and SMTP provider.
-
Partial
Self-hostable Weight 1 of 3
Can the webmail be installed on your own server?
The static web app can be built and served from another server, with a configurable API address, but there is no official self-hosting guide and it only works with the Forward Email API.
Automated tests
-
Partial
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade B
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B+ (80/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.