Getting Started

defnd.email uses end-to-end encryption. Your private key never leaves your device. We cannot read your data — by design.

After registration, your browser generates a keypair. The public key is stored on our servers. The private key stays with you.

1. Create account

Sign up at defnd.email/auth/register. Choose your username — this becomes your email address.

2. Save recovery phrase

You'll get a 24-word recovery phrase. Store it safely — it's the only way to recover access if you forget your password.

3. Start using

Access Mail, Calendar, Notes, and Passwords — all encrypted with your keys.

Mail

E2E encrypted email with @defnd.email address.

  • Web client only (encryption requires browser)
  • Send encrypted messages to external recipients
  • Receive and decrypt incoming mail
  • Attachments encrypted client-side

Calendar

Encrypted calendar with events, reminders, and categories.

  • All event data encrypted client-side
  • Recurring events support
  • Categories with colors
  • Offline support

Notes

Secure notes with folders and tags.

  • Note content encrypted before storage
  • Organize with folders and tags
  • Pin important notes
  • Offline editing

Passwords

Zero-knowledge password vault.

  • All credentials encrypted locally
  • Password generator
  • Import from other managers (CSV)
  • Organize with folders

Security

Security features to protect your account.

Two-Factor Auth

Enable two-factor authentication in Settings. We support TOTP apps (Google Authenticator, Authy, etc.).

Encryption

  • Key exchange: X25519 (Curve25519)
  • Encryption: XChaCha20-Poly1305
  • Key derivation: Argon2id
  • Recovery: BIP39 (24 words)

API

Send encrypted emails via REST API (Pro plan).

Getting started

  1. Add a domain and verify it (DNS) under Domains.
  2. Add a verified sender identity (a From address on that domain).
  3. Create an API key for the domain under API — copy it once; only its hash is stored.

Authentication

Pass your key as a Bearer token. Base URL: https://api.defnd.email/v1.

Authorization: Bearer dfnd_xxxxxxxx...

Send an email

from and reply_to must be verified sender identities on a domain your key is scoped to.

curl -X POST https://api.defnd.email/v1/emails \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "from": "hello@yourdomain.com", "reply_to": "hello@yourdomain.com", "to": "recipient@example.com", "subject": "Hello", "html": "<p>Message content</p>", "text": "Message content" }'

Idempotency

Pass an Idempotency-Key header (any unique string, max 255 chars) on POST /v1/emails to make retries safe: a repeated key within 24 hours returns the original response — marked with Idempotency-Replayed: true — instead of sending a duplicate. While the first request is still in flight, duplicates get 409 with Retry-After.

-H "Idempotency-Key: order-42-confirmation"

Other endpoints

  • POST /v1/emails/batch — send up to 100 messages in one request ({"emails":[ ... ]}).
  • GET /v1/emails, GET /v1/emails/{id} — list and check delivery status.
  • GET/POST /v1/templates, POST /v1/templates/{id}/render — reusable templates with {{variable}} placeholders.
  • GET/POST /v1/webhooks — email.queued / delivered / opened / clicked / bounced / unsubscribed events (HMAC-signed; HTTPS only).
  • GET /v1/suppressions, DELETE /v1/suppressions/{email} — bounce/complaint suppression list.
  • GET /v1/domains, GET /v1/domains/{domain}/stats — domains and sending stats.

Keys are scoped: requests are limited to the scopes you grant (transactional:send, transactional:read, templates:read, templates:write, webhooks:manage) and to the key's verified domains.

Webhook signatures

Every webhook request carries X-Defnd-Signature: sha256=<hex> — an HMAC-SHA256 of the raw request body with your webhook's secret. Verify it before trusting the event (the Node/Go SDKs ship a verifyWebhookSignature helper).