Plugins and themes for Bulwark Webmail.
Every extension here is free, open source and reviewed before it is published. Download the bundle and install it from the ZIP.
Open source only
Each extension has an OSI licence and a public GitHub repository.
Reviewed before release
An automated scan and a reviewer check every version.
Readable code
No minified or obfuscated code, and no telemetry.
Permissions up front
Each plugin lists what it can read and change.
Featured by the reviewers.
Browse every extension
Gravatar AvatarsLinus RathResolves Gravatar profile pictures for email contacts via the avatar transform hook
External Link WarningLinus RathWarns before opening external links to unknown domains. Admins can pre-populate a trusted domain list.
External Recipient WarningLinus RathWarns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.Recently added.
Newest first
PGP True End-to-EndPaulhenry SauxEnd-to-end OpenPGP for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming PGP mail. Private keys are encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally.
OpenPGPsamuelmiller36End-to-end OpenPGP (GnuPG-compatible) for webmail: generate, import, export and manage public and private keys; encrypt, decrypt and sign messages; and automatically verify signatures and decrypt incoming PGP/MIME and inline-PGP mail. Private keys are stored encrypted at rest and unlocked into memory only for the current session, so secret material never leaves your browser. Runs in the privileged (same-origin) plugin tier with a bundled openpgp.js engine.
S/MIMELinus RathEnd-to-end S/MIME for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming CMS (PKCS#7) mail. Private keys are imported from a PKCS#12 (.p12/.pfx) file, encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally with bundled pkijs/asn1js.
Spam ScoreLinus RathAdds a Spam Analysis section to a message's "More details" panel. Reads the raw spam-filter headers (SpamAssassin / Rspamd score, threshold and level, plus any AI verdict) directly off the message and shows a colour-coded breakdown.
Libravatar AvatarsShuki VakninResolves Libravatar profile pictures for email contacts via the avatar transform hook. Libravatar is a federated, privacy-friendly Gravatar alternative.
Calendar AgendaLinus RathShows an agenda of your upcoming calendar events in the sidebar.Most downloaded.
Most downloaded first
Impersonation NoticeLinus RathShows a persistent top-of-app banner when the active session is a Stalwart master-user impersonation (username contains '%'), with a configurable 'Return to platform' button. Detection is automatic; admins configure the platform return URL and banner styling.PGP True End-to-EndPaulhenry SauxEnd-to-end OpenPGP for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming PGP mail. Private keys are encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally.Gravatar AvatarsLinus RathResolves Gravatar profile pictures for email contacts via the avatar transform hookExternal Link WarningLinus RathWarns before opening external links to unknown domains. Admins can pre-populate a trusted domain list.Calendar AgendaLinus RathShows an agenda of your upcoming calendar events in the sidebar.Subway SurfersLinus RathWriting emails is boring - it doesn't have to be. Adds a Subway Surfers sidebar to the New Message dialog, picking a random 6-minute jump-in point from a one-hour gameplay video.Two kinds of extension.
Plugins add features through a typed JMAP client. Themes restyle the whole interface with CSS alone.
Build an extension.
The API is a typed JMAP client, a handful of interface slots and a manifest. The review rules are short and public.