Encrypted in transit
TLS protects connections between your browser or mail app and Zmail, and is requested for server-to-server delivery. Email delivery still depends on the receiving or sending server supporting secure transport.
SECURITY
Security you can understand.
Layered defences for your mailbox, honest boundaries for encryption, and controls that stay out of the way.
TLS
Authenticated mail
SPF, DKIM and DMARC help receiving systems verify legitimate Zmail messages and reject domain impersonation.
Spam and abuse controls
Reputation, protocol and content signals work together. Rate limits and subscription verification make automated abuse more expensive.
Protected operations
Administrative access is separate from mailbox access. Sensitive portal actions require server-verified sessions, anti-forgery checks and human verification.
Automatic ZMath Mail
For ready Zmail-to-Zmail recipients, webmail encrypts the body with independent inner and outer AES-256-GCM keys, wraps both keys to every recipient browser with ephemeral ECDH/HKDF, and signs the envelope with the sender device.
Optional extra protection
ZMath Shield: two inputs, two authenticated layers.
A passphrase creates an inner AES-256-GCM layer. A separate visual pattern creates the outer layer. Each input gets its own random salt, key and 600,000-round PBKDF2-HMAC-SHA-256 derivation in your browser.
- Protect a private note, a file up to 8 MB, or both
- Export and import one portable encrypted .zmath file
- Tampering is detected before protected content opens
- No plaintext, input or derived key is sent to Zmail
••••••••••••PassphraseInner-layer input
＋
Visual patternOuter-layer input
↓
◆
AES-256-GCM × 2Independent inner and outer layers
The honest boundary
Protected where supported. Standard everywhere else.
Automatic ZMath Mail applies only when every recipient is a ready Zmail webmail user, and this release protects the message body—not the subject, addressing metadata, drafts or attachments. Messages to external providers remain interoperable email protected with transport TLS where supported. ZMath Shield separately protects a selected note or file exported as a .zmath vault.
What we protect
Portal sessions, sign-up flows, mail transport, account operations and optional protected payloads.
What you control
Your Google account security, mail password, recovery material, connected devices and the links you open.
What no filter guarantees
No anti-spam or malware system catches every harmful message. Treat unexpected requests and attachments cautiously.
START SMALL. OWN MORE.
Open ZMath Shield Security without theatre.
Choose a memorable address and use local protection when a note or file needs it.