Imagine a web-based email app, such as GMail. The email should only be readable by the sender and the recipients. No one else, including the developer having access to the database server or application server should be able to read it.

Is there a way to do this? If not possible, what is the best we can do?

  • 2
    Client-side encryption would solve this.
    – Gumbo
    Apr 4, 2015 at 10:41
  • Watch out for homomorphic encryption. Apr 4, 2015 at 21:44
  • ProtonMail claims to do just that.
    – user
    Apr 4, 2015 at 22:55
  • @Gumbo how to store the key if the client is browser? Can it be just a human readable password? Apr 6, 2015 at 3:31

2 Answers 2


If I understand you question correctly, you could encrypt the email before it leaves your computer and only allow it to be decrypted by the recipient. Take a look at a product called Virtru (http://www.virtru.com). I am not affiliated with the company but am a happy user. The recipient doesn't have to be a Virtru user to be able to read your email securely (just prove they have access to the email account). All that is stored in the database server is the encrypted message (using something called Trusted Data Format (TDF)).

  • 2
    Any client-side encryption could do: GPG, minilock, etc.
    – schroeder
    Apr 4, 2015 at 21:04
  • how to store the key if the client is browser? Can it be just a human readable password? Apr 5, 2015 at 4:01
  • There are two ways that the private key can be stored if the client is the browser. 1) The user stores the key on their own system (in a text file, for example, on their local drive), or 2) The key is encrypted in the client using a password that the user remembers, then the encrypted key is stored on the server.
    – mti2935
    Nov 1, 2015 at 20:02

The app (server side) could encrypt the mail content before storing it, using an encryption key derived from the login password (which is of course unknown to the developer).

(if you are concerned about the developer changing the server software to bypass encryption or save a copy of the encryption key, he can do that with the client based encryption too. You have to trust the developer to some extent no matter what.)

  • "login password (which is of course unknown to the developer)." -> Since the developer has access to DB, he could derive the password, couldn't he? If the password were hashed, the program couldn't encrypt using password, could it? Apr 8, 2015 at 4:07
  • It could, since the user enters his password at login. Apr 8, 2015 at 9:28
  • Then the developer could just monitor the traffic coming to the app server and retrieve the password? Apr 9, 2015 at 5:18
  • Yes, as he can do that in any case. With all software, that deals with passwords. Apr 9, 2015 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .