The Webmail

The Webmail

Written on 24 September 2026 and brought up to 6.3.4 (27 September 2026, schema 6104), on 26 September 2026, from the root README's Self-service portal and webmail and the operator documents under hmailserver/docs that each section links. What is marked 6.3.4 is in 6.3.4 and not in 6.3.3. Brought up on 5 October 2026 to 6.3.6 (6 October 2026, schema 6108), for what 6.3.6 changes on this page. 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected here. 6.3.5's own changes to the webmail - the keyboard, and an Outlook-style invitation shown as one - are not yet written in.

The webmail is a mail client in the browser, served by the server itself at /portal on the REST listener. A person signs in with their mailbox address and password and gets their mail, their folders, their contacts - and, since 6.3.4, their calendars - and every account setting that is theirs to set. It is in the binary: nothing to install beside it, no PHP, no separate web server, and it fetches no font, image or stylesheet from anywhere.

It began in 6.2.28 as a self-service page, became a webmail in 6.3.0 and a mail client in 6.3.2, and 6.3.3 rebuilt it to the shape of Gmail and Outlook.com. A separate webmail such as Roundcube still works over IMAP if you prefer one.

flowchart LR
    B["A browser<br/>or the installed app"] -->|"HTTPS"| R["REST listener<br/>RestApiPort"]
    R --> P["/portal - the page"]
    R --> M["/api/v1/me/... - the account's own routes"]
    M --> S["The same message store,<br/>folders and settings<br/>IMAP and POP3 read"]
    W["Web services listener"] -->|"CalDAV, CardDAV"| S
    Phone["A phone"] -->|"IMAP, SMTP"| S
    Phone -->|"CalDAV, CardDAV"| W

Loading

Contents

• Turning it on
• What it is in 6.3.3
• What 6.3.4 adds
• A folder of a hundred thousand messages
• What the administrator decides
• What it does not do
• The full documents

Turning it on

The webmail is served by the REST listener, which is off until RestApiPort is set (8045 is the conventional port). Three things decide whether people can reach it:

What	Why
RestApiPort, and RestApiBindAddress	The listener itself. Bound to loopback (127.0.0.1, the packaged default on Linux) it answers only on the machine - fine behind a reverse proxy on the same host, useless otherwise
A certificate: RestApiCertificateFile and RestApiPrivateKeyFile, or the ACME certificate	The server requires TLS on a REST listener that is not bound to loopback. And the browser withholds its cryptography from a page that is not HTTPS, so S/MIME and OpenPGP in the page need it anyway
A reachable name	A person types https://mail.example.com:8045/portal, or you put a reverse proxy in front on port 443

On Windows these are on Monitoring & troubleshooting → API & monitoring in the Control Panel; on Linux, Installing on Linux step 7 and Running in a Container. The sign-in uses the same checks as an IMAP logon - lockout and auto-ban included. An account with a second factor enrolled cannot sign in with its own password alone: it uses an app password, or - since 6.3.4 - a passkey, single sign-on, or a recovery code beside the password, once. A mailbox whose messages are encrypted at rest (Message Storage) opens its key when the person signs in with their own password; the webmail has no card of its own for it.

Several features send people links - a message that expires, a password reset, a list's unsubscribe page, the quarantine digest. Each needs to know the address the webmail is reached at from outside: confidential_base_url, falling back to quarantine_digest_base_url and then to import_oauth_redirect_base_url. With none set, those features say so rather than send a link that leads nowhere.

What it is in 6.3.3

The page people know from Gmail and Outlook.com: a folder column with the system folders first, a list whose rows show sender, subject, first line, star, attachment and time, a reading pane beside or below it, a compose window docked at the bottom right, and settings behind the gear.

Area	In 6.3.3
Reading	Conversations grouped by thread; a message's HTML shown as the server's own document under a policy where nothing runs and nothing is fetched until the reader allows it; attachments downloaded or previewed; the raw headers with the SPF, DKIM and DMARC verdicts; a warning on a link whose text and target disagree
Organising	Labels as IMAP keywords with colours; tabs (Primary, Social, Promotions, Updates, Forums, or Focused and Other); mute, pin, block and sweep; drag and drop to folders; select a whole folder; snooze
Searching	One box, and operators - from:, to:, subject:, has:attachment, before:, after:, in:, is:unread, quoted phrases - with an options panel that builds them
Writing	A rich-text editor whose HTML is rebuilt from an allowed subset; a From picker over the account's own address, its aliases and mailboxes whose owners granted it; signatures; templates with {first_name}-style fields; undo send; send later; drafts; read receipts; a large file sent as an expiring link
Settings	Name and signature, theme and density, notifications, language; out of office and forwarding; filters (a rules editor that writes Sieve, or the script by hand); contacts; storage; app passwords; browser sessions; the S/MIME key store
Contacts	An address book that completes the To field, synced to phones over CardDAV from 6.3.3 (Connecting a Mail Client)
Security	S/MIME in the page since 6.3.2 - sign, verify, encrypt and decrypt with the browser's own cryptography, the private key wrapped with the account's password before the server stores it. Since 6.3.6 a signer's certificate is kept for encrypting replies only when its chain is trusted, only under the message's From address, which it must name, and a different one for an address that has one only when the reader chooses Keep this certificate, shown with its fingerprint (a correspondent's renewed certificate takes that one click); a correspondent whose certificate is self-signed or from an authority this machine does not trust is imported here once it has been checked with them. Certificates kept before the upgrade stay: the page lists each with its address and fingerprint, and Remove takes one out (SmimeAuthority.md)
Everywhere	Keyboard shortcuts (? lists them), a screen reader's landmarks and focus, a phone layout, the inbox and the last thirty opened messages kept for reading offline, twenty languages beside English

What 6.3.4 adds

Everything in this section came in 6.3.4, published 27 September 2026. Each row links the repository document that describes it in full.

Reading and organising

Feature	What it does
Important, and inbox sections	Gmail's importance marker, worked out in the browser from whom this person writes to and what they open, written as the $Important IMAP keyword so every client sees it, corrected in one press. The inbox can be drawn as Important, Starred and Everything else. The server learns nothing (ImportantMail.md)
Subscriptions	Settings, Subscriptions: every sender whose recent mail offers a way out, how much each sent and how much is unread, one button to leave by the way the newest message names, block and delete
Brand logos	A sender's BIMI logo as its avatar - only for mail this server judged dmarc=pass, only from a domain whose DMARC policy enforces, only as SVG Tiny PS (BrandLogos.md)
Recover deleted items	Outlook's recover items deleted from this folder: deleted mail kept aside for a window the administrator sets (off by default), which the person puts back themselves (RecoverDeleted.md). Under a legal hold the page also lists what the hold kept, whatever the window, and offers no delete for good (Compliance and eDiscovery)
Offline for the last N days	The text, formatting and attachments of the last days kept in the browser's own storage, read and searched with no connection, and forgotten at sign-out - the reader's choice, under a ceiling the administrator sets (OfflineMail.md)
A second account	Two mailboxes side by side at the top of the folder column, one press switching the whole page between them - Outlook's shape, not Gmail's (SecondAccount.md)
The installed app	The page installs as an app with the unread count on its icon; a photo or a link shared from another app lands in a new message, and mailto: links open here once the reader says so
Languages	Twenty-three beside English: to 6.3.3's twenty - the Control Panel's seventeen, and Greek, Korean and European Portuguese - 6.3.4 adds Arabic, Hebrew and Persian, for which the whole page is turned round right to left

Writing and sending

Feature	What it does
Emoji, pictures and tables	In the formatted editor; a picture is checked by its bytes, drawn down to 1,200 pixels and sent as an inline part Gmail and Outlook display (FormattedMessages.md)
Send as an address elsewhere	An address at another provider, proved by a six-digit code mailed to it, then offered in the From picker
Masked addresses	An address made for one shop or sign-up (bookshop.k3v9qa@example.com) that delivers here and can be replied from, and switched off the day it brings spam
Other accounts	Mail collected from another mailbox - an old provider, a second address, the folders brought over for a move - with Gmail and Outlook.com signed in to by OAuth rather than a password (Migration). Days to keep means one thing for POP3 and IMAP since 6.3.6 (-1 deletes a message once collected, 0 leaves it there, N deletes it N days later); a page loaded before the upgrade says the earlier meaning until it is reloaded, and a save from it is refused with reload the page
A message that expires	Gmail's confidential mode: the message stays on this server and a link goes instead; the reader proves they are a recipient, the sender can withdraw it early. Not end-to-end encryption - the server can read it while it exists (ConfidentialMessages.md)
Recall	An unread message sent to accounts on this server withdrawn from their mailboxes; the read copies stay, a recipient elsewhere is counted and never reached, and no notice goes to anybody (MessageRecall.md)
OpenPGP, and password-protected messages	End-to-end encryption in the page beside S/MIME, and a message to somebody with no key, encrypted to a password - see Encryption for People. Since 6.3.6 each compressed layer of a message is inflated to 32 MB at most; a larger one is refused with the message is larger than 32 MB once decompressed, more than this page opens; open it in a mail program
Reading a message (6.3.6)	A message's HTML shows its embedded images until 24 MB of data: URLs are written, every reference counted; a reference past that stays the cid: URL and shows no image (the 64 images, 4 MB each and 12 MB together, are as they were). An attachment the webmail decrypted (S/MIME, OpenPGP) is handed over as application/octet-stream; message attachments, files sent as links (/files/{token}) and contact photos keep their declared type only when it is on the list of types no browser runs or renders as a page (pictures other than SVG, sound, video, PDF, plain text and CSV, office documents, archives), application/octet-stream otherwise, and an SVG contact photo is no longer shown; a formatted signature reaches the page only as its editor's subset; where the keyboard is shows in violet. A second account shown beside the first: a file saved for it is always of no type, and a photo it shows, or an attachment its offline store answers, keeps the server's type only when that is an image type the page shows (or, offline, a PDF)

Calendar, tasks and contacts

Feature	What it does
Calendar and tasks	Month, week, day and agenda views over the same calendars a phone syncs over CalDAV; events made with a click, moved and resized by dragging; recurrence and reminders; several calendars with colours; tasks ticked off in the page or on the phone (Calendar.md)
Sharing and invitations	A calendar shared with a colleague, a group or a delegate who answers invitations on the owner's behalf; guests invited by mail (iMIP) with Accept, Maybe, Decline and a counter-proposal, the answer filed into the organiser's event on delivery; an availability strip from colleagues' free-busy. Since 6.3.6 the invitation's card says the calendar still has the event as it was when a message was not applied; Remove from calendar on a cancellation of some occurrences removes those alone; an invitation filed from an unverified organiser is marked X-HMAILSERVER-IMIP-UNVERIFIED, and the reader's answer replaces such a copy
Contacts	Several address books, shared with a colleague or a whole domain, read-only or writable; contact groups; collected addresses kept as Other contacts by choice; birthdays, notes, phones and photos from a phone's cards; import and export as vCard or CSV (SharedAddressBooks.md, Contacts.md)
The directory	Every active account and list of the person's own domain, with title, department, phones and photo, completing To, Cc and Bcc after their own contacts; an opt-out that is the person's (Directory.md). Meeting rooms and equipment are listed with their kind and capacity, and booked by inviting their address (Rooms and Equipment)

The Security page, and the person's own data

Feature	What it does
Passkeys	A WebAuthn credential on the person's own device signs them in instead of the password and stands in for the one-time code (Sign-in and Identity)
Single sign-on	Sign in with the organisation's OpenID Connect or SAML identity provider, when an administrator has named one
Recovery address and codes	A second mailbox of the person's, confirmed by a link, to which Forgotten your password? sends a half-hour reset link; and ten one-time codes that stand in for the authenticator (Sign-in and Identity)
Devices	Every client that has signed in as the account - browser, phone, mail program - with the credential it used, and a button that ends it and can turn off the app password it used
Zero-access	The person's own switch that encrypts delivered mail to their OpenPGP key, so that nobody else can read it - Encryption for People
Everything as one .zip	The person's mail as mbox, contacts as vCard, calendars, preferences, filters and the log lines naming the address, downloaded from their own Settings page (PersonalData.md)
Help	A help button on every page shows what the documentation says about it, from the server's own copy

A folder of a hundred thousand messages

6.3.4. Built, and not yet measured: the method and the table the timings go in are in Performance.md, and every cell of that table still says it is to be measured on the bench. What changed is how much of a large folder each request copies and reads, not a claim about how fast it is.

What the person does	What the server does since 6.3.4
Opens a folder	One pass over the folder copies only the page of 200 rows it shows, where it used to copy the whole folder for every page; each row's file head is read twice rather than three times. The first open after a start, or after thirty idle minutes, still reads the folder's rows from the database, as an IMAP SELECT does
Scrolls	Older and Newer move a page at a time; a folder of three pages or more also offers Oldest, which opens the last page in one request
Searches	A request opens at most 2,000 message files and stops after about two and a half seconds, saying where to go on from; Search older messages carries on. With the full-text index on (IndexerFullText, off by default) a message the index rules out is passed without opening its file. The search of every folder walks the whole mailbox newest first and goes on from where it stopped, where it used to stop in the first large folder
Selects the whole folder and acts	Mark as read, Mark as unread, Archive, Junk, Delete and Move hand the selection to the server (POST /api/v1/me/folders/{id}/bulk), which works through it a bounded step at a time - up to the newest message the page had shown, so mail arriving meanwhile is not swept up - and the bar counts Done so far. It used to stop at five thousand and send a request per message

Two things a program other than the webmail may notice: GET /api/v1/me/search now answers complete: false, more: true with next_before_id whenever an answer is not the end of the search, where it used to say complete: true with hits it could not reach, and its hits are newest first across every folder rather than folder by folder. And Junk over a whole folder with SpamAssassin on queues one lesson for each message moved, as the same move over IMAP does. A quick step over a whole-folder selection still stops at five thousand.

What the administrator decides

The person sets their own preferences, filters, signature, reply, keys and devices. These are the administrator's, each a setting on PUT /api/v1/settings and the Control Deck's Settings view, and each off or bounded until changed. Since 6.3.4 many of them can also be set per domain or per account (Profiles and Environment):

Setting	What it bounds	Default
recover_deleted_days	How long deleted mail can be put back	0, off; at most 365
reader_offline_days_max	The most days a reader may keep offline	30; 0 offers none
recall_days	How long after sending a message can be recalled	14
reader_masked_addresses_max, reader_sender_addresses_max	Masked addresses and verified send-as addresses per person	20 and 5
brand_logos_enabled	Brand logos at all	on (needs AuthenticationResultsEnabled and DMARC)
account_recovery_enabled	The recovery address, codes and password reset	on, and inert until a base URL and a person's own address exist
The session policies	Idle timeout, lifetime, one session per device, a session bound to its address - server-wide or per domain	the ceilings the server always had: 30 minutes idle, 12 hours
passkey_relying_party, the OIDC and SAML settings	Sign-in by passkey and single sign-on	passkeys offered; single sign-on off until an identity provider is named

A domain decides its own disclaimer, quota policy, out-of-office window, restricted delivery and impersonation protection, which the webmail shows the result of. Mail flow rules reach the webmail's send too: a rule that rejects refuses the send in the page with the rule's text, and nothing is queued.

What it does not do

• No ActiveSync, no Exchange Web Services. A phone uses IMAP and SMTP for mail and CalDAV and CardDAV for the calendar and contacts, as Connecting a Mail Client describes.
• Passkeys and single sign-on do not reach IMAP, POP3 or SMTP. A mail client still takes the password or an app password.
• Offline storage is the browser's. Anyone who can use that browser profile while the person is signed in can read what is kept; it is gone at sign-out.
• Important and the inbox sections are a browser heuristic, not Gmail's model, and do not follow the person to another browser except through the $Important keywords on the mail.
• A message that expires is not end-to-end encrypted, and nothing stops a recipient photographing the screen.
• Recall reaches this server's own mailboxes only, and only unread copies.
• The pages that are not the webmail itself - a list's subscribe and archive pages, the quarantine digest's pages - are in English.

The full documents

The webmail's own behaviour is spread over the operator documents named above; the index of all of them is hmailserver/docs/README.md, the keyboard map and search operators are WebmailShortcuts.md, and every route the page uses is described in the OpenAPI document the server serves at /api/v1/openapi.json (The REST API).

See also: Connecting a Mail Client · Sign-in and Identity · Encryption for People · The Control Deck · Security Hardening