I am thinking about building an e-mail web client that I can run on my server as a side project. The server addresses should be configured on the server side.

Multiple Accounts should be able to access their emails through the client.

As I see it, for POP/IMAP/SMTP the credentials have to be sent with every request, so I need to store them somewhere.

What is the most secure way to do this?

1 Answer 1


Since your web mail client is just a front end to some existing email account you can simply use the IMAP/POP login information as the login information for your web mail client. In this case you don't need to store any credentials permanently for retrieving the mail.

Since you probably need access to the credentials while the user is still logged into your web mail application and you don't want to ask the user again, you might include the credentials in encrypted form inside the session cookie, for example as encrypted payload inside a JWT based cookie.

While many (most?) mail providers have the same credentials for IMAP/POP and for SMTP they might be different for some providers. In this case you could encrypt the SMTP credentials with a key derived from the IMAP/POP credentials so that they are only accessible for somebody having the IMAP/POP credentials already. You might then store this encrypted credentials in a database or you might store it only at the client side, for example in the browsers local storage or in some cookie with a really long expiration time. Storing these encrypted information at the client side has the advantage that no sensitive client information need to be stored at the server side at all.

  • If I save the password in a JWT it should be encrypted before, since JWT are only signed, not encrypted, right?
    – Dominik G
    Jun 10, 2018 at 14:06
  • 1
    @DominikG: thanks for the comment. I've edited to make it more clear that the payload should be encrypted. Jun 10, 2018 at 14:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .