Email Providers

MailVault connects personal Outlook.com, Hotmail and Live.com accounts through the Microsoft Graph API. Add the account, choose Sign in with Microsoft and complete sign-in in your browser. MailVault recognizes a personal Microsoft account and uses Graph on its own, so there are no IMAP settings to enter.

It does not use IMAP for these accounts because of a Microsoft IMAP problem with OAuth2 sign-in that began in late 2024. Reading, deleting, marking as read or unread, moving and backing up mail work as on other accounts.

Not available on Graph accounts yet:

• Snooze
• Restoring an MBOX file to the server
• Recover to server for deleted emails. Recover locally works, for mail already on this computer
• The Inbox count that the add-account window reports after the connection test

Microsoft 365 Business and Enterprise accounts use IMAP with OAuth2 and are not affected by these limits. That sign-in follows the same approach as Mozilla Thunderbird, with PKCE and XOAUTH2 authentication.

Proton Mail encrypts your mail end-to-end, so it doesn't expose IMAP directly. Connecting it to MailVault (or any third-party mail client) requires Proton Mail Bridge — a desktop app from Proton that runs on your own computer and exposes your encrypted mailbox as standard IMAP/SMTP on 127.0.0.1. Bridge requires a paid Proton Mail plan; it isn't available on Proton's free tier.

Setup steps:

1. Install Proton Mail Bridge from Proton's website
2. Sign in to Bridge with your Proton account
3. Bridge displays per-account IMAP/SMTP credentials — the password shown is a Bridge-generated app password, not your regular Proton account password
4. In MailVault, choose Proton Mail Bridge in the provider list (or Custom IMAP if it isn't listed) and enter:
   • Server: 127.0.0.1
   • IMAP Port: 1143, Security: STARTTLS
   • SMTP Port: 1025
   • Username: your Proton email address
   • Password: the Bridge-generated password from step 3

Proton Mail Bridge must be running in the background whenever MailVault syncs — if Bridge is closed, MailVault can't reach the mailbox. Mail you've already archived stays fully readable and searchable in MailVault even while Bridge is closed, since MailVault is local-first and reads from its own .eml store rather than live from Bridge.

Bridge secures its local IMAP/SMTP server with a self-signed TLS certificate. MailVault handles this automatically for local (127.0.0.1) connections, so no manual certificate installation is required.

Yes. Add the address as an alias of the account, as described in How do I send from an alias?, then pick it in the From row when you write, or make it the default. This is common on Fastmail and on any provider where the address you sign in with is not the address you hand out.

Only the From address on outgoing mail changes. Your username and password stay exactly as they are, MailVault still signs in as the account you set up, and no Reply-To header is added — replies go to the address you send as.

Open Settings → Accounts, pick the account and go to its Aliases section. It lists every address the account sends from: its login address first, then each alias. The Add address link in the From row of a new message opens the same section.

Adding and setting up an alias:

• Google accounts: if you signed in with Google, MailVault fetches the addresses Gmail lets you send as and lists them for you.
• JMAP accounts: sending addresses come from the identities configured on your server. Add or change them there.
• Other providers: MailVault suggests addresses it has seen in your own mail, the ones you have sent from and the ones your mail arrives at. You can also add any address by hand.
• Name: give each alias the name recipients should see. Mail sent from the alias goes out under that name.
• Default: choose which address new messages start from.
• Verify: sends one test message from the alias, so you can see whether your provider accepts it before you rely on it.

Your provider has to allow the address:

• Fastmail: add the address as an alias or identity in Fastmail first.
• Gmail: add it in Gmail under Settings → Accounts and Import → Send mail as.
• Microsoft 365 and Outlook.com: aliases are added in the Microsoft account, by you or, on a work or school account, by your administrator.

Only the From address and name change. MailVault still signs in as the account you set up, and no Reply-To header is added, so replies come back to the alias.

Choose Fastmail when adding an account and paste an API token with Mail and Submission access from Fastmail settings. For another server, choose JMAP and use its password or API token. MailVault discovers the session URL when the domain publishes it; otherwise enter the full HTTPS session URL. Confirm an unfamiliar discovered server before credentials are sent. New mail uses push with polling as a fallback, and sending addresses come from the server’s identities. Fastmail also offers an IMAP app-password option.