SpamEater gives you a disposable inbox on your own domain that burns itself down 24 hours after you create it. Type any name, or roll the dice for a random one, and mail sent to that address lands in a clean web inbox that refreshes itself every few seconds. Open a message and HTML mail renders faithfully, adapted to the dark interface, with inline images embedded and remote images blocked until you ask for them, so tracking pixels never fire behind your back. A live countdown in the corner tells you exactly how long the inbox has left, and a copy button grabs the address for the form you are about to fill. There are no accounts to create, no passwords to remember, and nothing to recover once the timer ends: the inbox, the messages, and the paper trail vanish together. Behind the scenes the service takes its own security seriously, with a web application firewall, intrusion prevention, rate limits, and mail bodies encrypted at rest. Dark and light themes switch with one toggle. Developers use it to test signup flows and password resets, and everyone else uses it to keep a real address out of reach of newsletters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Sign up for a new service and you face a familiar choice: hand over your real email and get spam-listed forever, or generate a throwaway alias that dies when you close the tab. AliasVault eliminates that trade-off by combining a password manager with a built-in email server, so every website gets a unique identity (random email, generated name, strong password) and incoming emails land directly in your encrypted vault rather than your primary inbox. Creating a new alias takes one click: the system generates a random address on your configured domain, a fake identity with name and birthdate, and a cryptographically strong password, all stored in a zero-knowledge encrypted vault that even the server administrator cannot read. Browser extensions for Chrome, Firefox, Edge, Safari, and Brave detect login forms and autofill credentials or prompt you to create a new alias on the spot. Native iOS and Android apps with biometric unlock provide mobile access to your vault and integrate with the operating system's autofill framework. The built-in TOTP authenticator generates time-based one-time codes without needing a separate app. Import existing credentials from other password managers through standard export formats, and export your vault data at any time for full portability. Self-hosting via Docker with your own email domain gives you complete control over where alias mail is received and stored, with no third-party dependencies. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your scanner still emails PDFs, your backup scripts still send nightly reports, and none of them will ever learn OAuth 2.0: Email OAuth 2.0 Proxy learns it on their behalf. It listens on local IMAP, POP, and SMTP ports on your server, and when a client logs in the old-fashioned way with a username and password, the proxy swaps that exchange for a modern SASL XOAUTH2 token before the connection ever reaches the provider. The client never knows anything changed, so ancient mail apps, embedded devices, monitoring tools, and hand-rolled scripts keep sending and fetching mail through Outlook, Office 365, Gmail, Google Workspace, Fastmail, Yahoo, AOL, and any other provider that demands OAuth 2.0. The hop from your client to the proxy stays simple, while the proxy opens a fully encrypted TLS connection upstream, including STARTTLS negotiation for SMTP relays that require it. One proxy instance serves many accounts at once, with each mailbox mapped to its own local port and its tokens cached under a password you control. Optional plugins can even rewrite traffic in flight: strip Microsoft Defender Safe Links back to their real URLs, stop duplicate sent messages, or swallow test mail into a black hole. Setup is a single configuration file covering server ports, per-account scopes, and token endpoints, and the proxy then runs quietly as a headless service. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Mailflow gathers every mailbox you own, the work account, the personal one, and the address stranded at a provider you left years ago, into one unified inbox hosted on your own server. All accounts merge into a single stream sorted by date, then sort themselves into Primary, Newsletters, Social, Notifications, and Other tabs, with a reclassify button for the ones that land wrong. Conversations group into threads, one click unsubscribes from detected newsletters, and full-text search reaches across every connected account at once. Writing mail gets a proper editor with formatting, tables, emoji, attachments, and smart address completion that learns from what you send, while inbox rules and a block list quietly move, archive, star, or trash messages by sender, subject, or content before you ever see them. New mail arrives with real-time toasts and push notifications, the interface installs as an app, speaks eleven languages, and can be reshaped with layouts, themes, and your own CSS. Accounts stay protected with two-factor authentication and single sign-on, contacts sync out over CardDAV, and an optional AI assistant can summarize a thread or draft the reply you are avoiding. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

SnappyMail is a fast, privacy-respecting webmail client that connects to any existing IMAP and SMTP server, booting in under a second with a JavaScript payload of just 138 KB under Brotli compression (down from RainLoop's 8 MB fork origin). No database is required: all configuration and user data persists as flat files in a single volume, making Docker deployment trivially simple with the roughly 30 MB image consuming approximately 50 MB of RAM. Built-in PGP encryption supports three backends: OpenPGP.js v5 with ECDSA and EDDSA key generation, GnuPG integration, and Mailvelope browser extension compatibility, eliminating the need for separate encryption plugins. The integrated Sieve script editor enables users to create mail filtering rules, vacation auto-responders, and forwarding conditions directly within the web interface when connected to ManageSieve-capable servers on port 4190. Multi-domain administration allows a single instance to serve users across multiple IMAP servers with per-domain authentication routing. The admin panel manages extensions, security settings, branding customization, and domain configuration. GDPR-friendly by design, it removes all social media integrations, Gravatar lookups, and external tracking present in RainLoop. Dark mode strips background and font colors from email messages. The modified Squire HTML editor replaces CKEditor for composing rich-text messages. Scores 99% on Lighthouse performance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Five mailboxes, five tabs, five passwords: Gofer folds Gmail, Outlook, iCloud, and plain IMAP accounts into one browser tab where every inbox reads as a single, searchable whole. Threads, labels, and drag and drop keep triage fast, and search still finds the receipt from three years ago. Signatures and custom senders shape outgoing mail, scheduled sends wait for Monday morning, and a thread in another language translates in place. The calendar keeps pace with your mail: Google, Outlook, and CalDAV events sync both ways, invitations land in the inbox, and an RSVP or a Meet or Teams link attaches without leaving the message. Contacts follow the same rule through Google, Outlook, and CardDAV sync, so the address book you fix once is right everywhere. One install can serve a household or a small office, with separate users, encrypted credentials, blocked remote images, and passkey or authenticator sign-in for anyone who wants it. Classic, Minimal, and retro Express themes, flexible layouts, and push notifications make the daily inbox feel personal rather than administered. Leaving stays easy too: mailboxes export as mbox, mail moves between accounts, and a whole setup imports into another Gofer. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Gmail, Outlook, and every IMAP mailbox you own share one inbox, one search box, and one calendar in plMail, a mail client you host yourself. Accounts sit side by side with sending aliases, and new mail arrives on its own through IMAP IDLE, Gmail and Outlook push, and browser notifications. Credentials are encrypted before storage. Search understands from:, subject:, label:, has:, and before:, completes as you type, and highlights matched words. Filters are nested any, all, or none trees, and each shows how many real messages match before you save it. Drag several conversations at once onto folders, labels, or inbox tabs; a label adds itself without removing the mail from your inbox. A calendar sits beside the mail, with two-way sync for Google, Microsoft, and CalDAV. Move events on the week grid, answer invitations in place, and send share and booking links. An optional language model, pointed at your own Ollama server or any OpenAI-compatible endpoint, searches by meaning, drafts replies, summarizes threads, and sorts mail into tabs once you switch it on. Attach files from and save them to Drive, OneDrive, Dropbox, Nextcloud, Immich, and Paperless-ngx. Sign in through Authentik, Keycloak, or any OpenID Connect provider, and pick from 41 themes. Android and iOS apps connect to your own server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every email account you own lands in one combined inbox with Cypht, putting Gmail, Outlook, a work Exchange server, and your RSS feeds behind a single login. Combined views do the heavy lifting: one inbox, one unread list, one sent folder, and one flagged list span every connected account, and each account still keeps its own folder tree when you need to work inside a single mailbox. Messages move freely once they are together: search across all accounts at once, then copy or move mail between accounts, flag favorites, and clear out large mailboxes from the same list. Sending identity stays organized through profiles, which pair an incoming account with an outgoing SMTP server and attach a signature and reply-to address, so the right name and footer go out with every message. New accounts connect over IMAP, JMAP, or Exchange Web Services, and provider auto-discovery fills in server settings for major services instead of making you look up ports. Everything is a module set, so LDAP authentication, folder sharing, and integrations like WordPress and GitHub can be switched on or left out entirely. Pages stay small and quick on modest connections, which suits the ISPs, schools, and small teams Cypht was built for. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. LGPL-2.1 licensed.

For operators running email at real scale, WildDuck moves accounts and messages into MongoDB and scales by adding stateless servers behind a load balancer. Any standard mail app connects over IMAP with IDLE push, CONDSTORE sync, compression, quota reporting, and special-use folders, or over POP3 for simple download-and-delete reading. International addresses and folder names work natively, so mailboxes written in Cyrillic, Arabic, or Chinese scripts are first-class citizens rather than encoding errors. Everything an operator touches is an API call: create users, set quotas, edit filters and auto-replies, publish DKIM keys, read audit logs, and move messages between mailboxes without editing a config file. Accounts defend themselves with two-factor authentication by authenticator app or security key, application passwords for older clients, and optional PGP encryption of stored mail. Pair it with Haraka to receive SMTP mail and ZoneMTA to send it, and the three services form a complete mail platform with no single point of failure. Attachments spill into GridFS or S3 storage and Redis keeps sessions and queues moving, so a failed node interrupts nothing that a replica cannot resume. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EUPL-1.2 licensed.

Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 7,100 GitHub stars and 200 contributors since 2016, Mailu has become one of the most popular self-hosted email solutions, delivering a complete production-ready mail server stack as pre-configured Docker containers that eliminate weeks of manual setup. The platform bundles Postfix for SMTP and Submission with auto-configuration profiles for Thunderbird, Outlook, and mobile clients, Dovecot for IMAP and POP3 with full-text search across email attachments, Rspamd for intelligent spam filtering with auto-learn Bayesian classification, greylisting, SPF and DMARC validation, and ClamAV for antivirus scanning of attachments with configurable malicious file blocking. The web administration interface provides global admin controls, per-domain delegation, user quota management, domain aliases, custom routing rules, and announcement capabilities. Users access self-service features including aliases, auto-reply, auto-forward, fetched accounts from external mailboxes via fetchmail, and Sieve filter management through ManageSieve. Security features include enforced TLS on all connections, automatic Let's Encrypt certificate provisioning, outgoing DKIM signing, DANE and MTA-STS support for transport security, and Snuffleupagus PHP hardening for the web interface. The setup wizard at setup.mailu.io generates complete Docker Compose configurations tailored to specific deployment requirements. All components are free and open-source software with zero proprietary dependencies and no tracking. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Modoboa turns a bare mail server into a managed hosting platform, with one web console for domains, mailboxes, aliases, and quotas, plus a full webmail for the people using them. Roles separate super administrators, resellers, domain administrators, and ordinary users, with caps on how many mailboxes and aliases each administrator may create and daily sending limits per domain or mailbox. The webmail offers conversation view, folder subscriptions, scheduled sending, attachments, and search across headers and message bodies. Calendars and address books sync with standard clients, and calendars can be shared. Each user writes Sieve filters and autoreplies in the browser. Deliverability checks cover MX records and DNSBL listings, DKIM keys are generated per domain, and DMARC aggregate reports become per-domain visual reports. Amavis quarantine pages and an Rspamd frontend help with spam. Traffic graphs show message volume. Accounts authenticate against the local database, LDAP, Active Directory, or an existing SMTP server, with TOTP codes or WebAuthn security keys as a second factor. Thunderbird and Outlook configure themselves through built-in autoconfig and autodiscover endpoints. An IMAP migration tool pulls mailboxes from another provider as each person signs in. Administrators can brand the console with custom logos, extend it through plugins, and automate it through a documented REST API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. ISC licensed.

Parse DMARC reads the DMARC aggregate reports that Google, Microsoft, and Yahoo email about your domain every day and shows you, in one dashboard, who is sending mail as you and whether it passes authentication. It fetches the reports over IMAP, unpacks the gzip, zip, and XML attachments automatically, and charts your pass rate, message volume, and top sending sources at a glance. Any report opens down to its raw records, so when an unfamiliar IP starts sending as you, the evidence is one click away instead of buried in XML. Reports forwarded through Exchange or Outlook as message attachments are unwrapped too, and a local Maildir intake covers servers where the mailbox lives on the same host. A built-in generator writes your _dmarc TXT record from a form, so tightening your policy does not mean hand-writing DNS syntax from memory. Twenty-eight Prometheus metrics and a shipped Grafana dashboard move the same data into the monitoring stack you already run. An MCP server lets an AI assistant query your reports directly, asking which sources failed DKIM this week in plain language. Everything stores in a single SQLite file inside one static Go binary, with dark mode for late-night incident reviews. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

OneTimeSecret turns a password or private note into a single-use link that destroys itself the moment the recipient opens it. Create a secret in seconds from the web form: paste the text, optionally lock it behind a passphrase, and pick how long the link stays alive, from minutes to days. Send the generated link by email straight from the app, or drop it into any chat or ticket where a credential needs to change hands. Because the link burns after one view, a forwarded message or an old thread search cannot leak what was shared; once the recipient reads it, the content is gone for good. An API issues secrets programmatically, so scripts can hand database passwords or access tokens to teammates without writing them into CI logs or shell histories. Use it anonymously for quick one-off shares, or switch on full authentication with accounts, multi-factor authentication, and WebAuthn keys for a controlled internal service. Custom domains let the links carry your own hostname, so recipients see a service your organization operates rather than a public website. Admins manage users, domains, and access from a built-in console suited to teams that hand over credentials every day. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With nearly 3,000 GitHub stars and active development since 2014 through version 14.2.0, Yopass eliminates the universal bad habit of sharing passwords and API keys through Slack messages, email threads, and ticket systems by encrypting secrets entirely in the browser using OpenPGP before anything reaches the server. The Go backend stores only ciphertext — it never sees plaintext — while the React frontend handles all encryption and decryption client-side, generating one-time URLs that self-destruct after a single viewing or when the configured expiration of one hour, one day, or one week passes. File upload support streams encrypted files with configurable size limits, and optional custom password protection adds a second encryption layer beyond the URL-embedded key. The server supports Redis or Memcached as storage backends with automatic key expiration, deploying via Docker Compose in under five minutes or as Kubernetes manifests for production environments. Built-in TLS support works alongside reverse proxy configurations for Nginx, Caddy, and Traefik with automatic Let's Encrypt certificate provisioning. Prometheus metrics expose HTTP request counts, latency histograms, and secret lifecycle counters for Grafana dashboard integration and alerting. Read-only mode enables split-instance deployments separating secret creation from retrieval across different network zones. Multi-language support localizes the interface for international teams. The open-source core under Apache 2.0 provides full self-hosted functionality with no account management required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.