Korax

PGP-First Email. Private by Default.

Korax is an email client built around a single principle: encryption should be the default, not the exception.

Most clients bolt PGP on as an afterthought — a plugin, a hidden setting, a third-party extension. Korax is designed from the ground up so that signing, encryption, and key management are a seamless part of your everyday workflow. Your mail stays between you and the people you write to.

Features

PGP encryption and signing — native, not a plugin. Compose encrypted mail as naturally as plain text.
TOFU trust model. "Trust On First Use" with visual indicators: see at a glance whether a contact's key is known, trusted, or changed.
No tracking pixels. Remote images are blocked by default. Autoload only for contacts whose public key you have saved.
Local-first. All messages cached in SQLite on your device. Instant load, works offline, nothing sent to any cloud.
Multi-language. English, German, Spanish, Finnish, Russian, Swedish.
Linux: always free, always fully unlocked. No paywall, no nag screens. Honor system.

Download

Linux (AppImage)

The Linux release is a self-contained AppImage — no installation required.

Download Korax-x86_64.AppImage from the Releases page.
Make it executable:
```
chmod +x Korax-x86_64.AppImage
```
Run:
```
./Korax-x86_64.AppImage
```

macOS · Android · iOS

Coming soon.

Free vs Pro

Feature	Free	Pro
Send & receive email	✓	✓
IMAP accounts	Max 3	Unlimited
Basic PGP encryption / decryption	✓	✓
Generate PGP keypair	Max 1	Unlimited
PGP key import / export	View only	✓
Keyserver auto-lookup (WKD)	—	✓
Custom email signature (no watermark)	—	✓
Smart rules & filtering	—	✓
Unified inbox & custom swipe actions	—	✓
Premium themes	—	✓
Burn-after-reading (Korax-to-Korax)	—	✓
Linux	Always Pro	Always Pro

Pro is a one-time purchase. All Pro features are free during the current beta period.

Under the Hood

Architecture

Flutter UI (Dart)
      │
flutter_rust_bridge (FFI)
      │
   mailcore (Rust)
   ├── IMAP client
   ├── SMTP client
   ├── SQLite storage
   ├── MIME parser
   └── DNS SRV discovery

The UI layer never blocks: all network and crypto operations run in Rust, communicated to Dart via an FFI bridge with zero copy overhead.

Layer	Technology
UI	Flutter / Dart
Core engine	Rust (`mailcore`)
FFI bridge	flutter_rust_bridge
Cryptography	sequoia-openpgp
Local storage	SQLite
State management	Riverpod

mailcore — Open Source Engine

mailcore is the Rust library at the heart of Korax. It handles everything below the UI:

IMAP client — RFC 3501 compliant, UIDVALIDITY-aware, uses BODY.PEEK[] to preserve \Seen flag integrity
SMTP client — RFC 5321 with STARTTLS and SMTPS
SQLite storage layer — local message cache, folder state, account credentials
MIME parser — RFC 2045/2046 multipart handling
DNS SRV auto-discovery — resolves _imaps._tcp and _submission._tcp before falling back to defaults; same mechanism used by Thunderbird, Evolution, and others

The source is published here for transparency and community audit. It is licensed under the PolyForm Noncommercial License 1.0.0 — free to read, study, and use for noncommercial purposes. Commercial use requires a separate agreement.

What stays proprietary:

The PGP/Sequoia integration, advanced privacy features, and the Flutter UI (korax/) are not published. A second Rust library — mailmore — will eventually hold additional proprietary engine capabilities.

Security

Reporting vulnerabilities: Do not open a public issue. Contact the maintainer directly at the address shown in the application's About screen.

Key storage: Private keys are never written to SQLite or disk in plaintext. On every platform, they are stored in the OS secure enclave (iOS Keychain, macOS Keychain, Android Keystore).

About

Created by Eugen Kaparulin.
Official binaries distributed by K-Ops Oy.