Find an extension.

PGP True End-to-End

by Paulhenry Saux

plugin

End-to-end OpenPGP for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming PGP mail. Private keys are encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally.

OpenPGP

by samuelmiller36

plugin

End-to-end OpenPGP (GnuPG-compatible) for webmail: generate, import, export and manage public and private keys; encrypt, decrypt and sign messages; and automatically verify signatures and decrypt incoming PGP/MIME and inline-PGP mail. Private keys are stored encrypted at rest and unlocked into memory only for the current session, so secret material never leaves your browser. Runs in the privileged (same-origin) plugin tier with a bundled openpgp.js engine.

S/MIME

by Linus Rath

plugin

End-to-end S/MIME for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming CMS (PKCS#7) mail. Private keys are imported from a PKCS#12 (.p12/.pfx) file, encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally with bundled pkijs/asn1js.

Spam Score

by Linus Rath

plugin

Adds a Spam Analysis section to a message's "More details" panel. Reads the raw spam-filter headers (SpamAssassin / Rspamd score, threshold and level, plus any AI verdict) directly off the message and shows a colour-coded breakdown.

Libravatar Avatars

by Shuki Vaknin

plugin

Resolves Libravatar profile pictures for email contacts via the avatar transform hook. Libravatar is a federated, privacy-friendly Gravatar alternative.

Calendar Agenda

by Linus Rath

plugin

Shows an agenda of your upcoming calendar events in the sidebar.

External Mail Warning

by Linus Rath

plugin

Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.

Impersonation Notice

by Linus Rath

plugin

Shows a persistent top-of-app banner when the active session is a Stalwart master-user impersonation (username contains '%'), with a configurable 'Return to platform' button. Detection is automatic; admins configure the platform return URL and banner styling.

Jitsi Meet

by Linus Rath

plugin

Adds a 'Add Jitsi Meeting' button to calendar events. Meeting URLs are generated server-side via the /api/jitsi sidecar.

Gravatar Avatars

by Linus Rath

plugin

Resolves Gravatar profile pictures for email contacts via the avatar transform hook

External Link Warning

by Linus Rath

plugin

Warns before opening external links to unknown domains. Admins can pre-populate a trusted domain list.

External Recipient Warning

by Linus Rath

plugin

Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.

Writing emails is boring - it doesn't have to be. Adds a Subway Surfers sidebar to the New Message dialog, picking a random 6-minute jump-in point from a one-hour gameplay video.

Per-email sticky notes in the sidebar — jot notes while reading emails