Skip to content

Home

Jump to bottom
SkimMail docs edited this page Sep 18, 2026 · 12 revisions

English · Tiếng Việt · 中文

SkimMail

Skim all your inboxes. SkimMail is a lightweight, self-hosted, read-first multi-account email reader: an IMAP core with Gmail and Outlook OAuth, packaged as a single Go binary that embeds its React interface. SQLite is built in, so a working install needs no database server, no message queue, and no external service of any kind.

Current release: 1.18.0 (2026-09-18) · Linux and macOS, amd64 and arm64 · Community Edition is free.

Start here

If you want to… Go to
Get it running in the next ten minutes Installation
Point it at your domain, set up OAuth, or change how sign-in works Configuration
Understand what a specific feature does the Feature pages below
Back it up, read its logs, update it, or add a plugin Operations
Give somebody else a sign-in, or take one away Users and roles
Lock it down before exposing it to the internet Security
Fix something that is broken Troubleshooting · FAQ

The fastest path from nothing to a running inbox:

curl -fsSLO https://lyquyduong.github.io/skimmail/docker-compose.yml
docker compose up -d
# then open http://localhost:8080

On first start SkimMail prints a one-time claim code. You need it to create the first account, and it is the thing that stops a stranger from claiming your instance before you do — see Security.

What SkimMail does

Reading mail from everywhere at once

  • Multi-account IMAP — any server, host and port plus an app password.
  • OAuth for Gmail and Outlook (XOAUTH2 over IMAP). Optional, and it uses your own Google or Azure application credentials — SkimMail has no shared app and phones no vendor. Since 1.18.0, an instance with no public HTTPS address can still connect one: approve the sign-in, copy the address it fails to load, and paste it back. See App password or OAuth? and Accounts.
  • Unified inbox with lightweight threading and a three-pane layout. The reading pane is sandboxed: HTML is sanitised and remote images are withheld until you press Show images — and when you do, SkimMail fetches them itself, through that account's own egress. See Remote images in mail.
  • Account groups — named and colour-coded, so twelve mailboxes stay legible.
  • Real-time delivery via IMAP IDLE pushed to the browser over a WebSocket, with polling as a fallback. The backend keeps syncing whether or not a browser is open.
  • Two-tier search — a local SQLite FTS5 index over subjects and senders, with an optional server-side search when the local index cannot answer. See Search.

Getting through it quickly

  • Snooze, pin, split-inbox bundles with message counts, multi-select with bulk actions, and one-click unsubscribe (RFC 8058).
  • Starred — everything you marked, across every account, in one view (Starred, 1.13.0) — and Move to folder in the reading pane, with the same undo as Archive (Move to folder, 1.13.0).
  • Muted and VIP senders, listed and undoable in Settings ▸ Security, and yours alone rather than the whole instance's since 1.13.0. See Muted and VIP senders.
  • Keyboard-first throughout, plus a focus/triage mode and a command palette (⌘K).
  • Installable as a PWA, with browser web push for the mail you actually care about.
  • Interface in English, Tiếng Việt and 中文, dark and light.
  • Tags — press T to tag a message by hand, or let a rule tag it as it arrives; one-click filtering, a tag: search operator, and an eraser to rename, merge or remove one everywhere (all since 1.16.0). See Tags — and, optionally, read-only chips for the tags you set in another mail client: Server keywords.
  • Screenshot-safe mode — substitute every address, name and subject on screen with a realistic stand-in, so you can capture the interface without publishing your mail. Off by default; see Screenshot-safe mode.

Running it like infrastructure

  • Rules and signals — match mail, then tag it, notify you, or call a webhook. Channels include Telegram, Slack, Discord, Teams and Google Chat.
  • Per-account egress — send each account's IMAP traffic through a SOCKS5/HTTP proxy, an embedded WireGuard tunnel, or a serverless relay you deploy yourself. Egress is fail-closed: if the path you chose is down, the account is marked degraded and stops syncing rather than quietly leaking out of your home IP.
  • Sync health — a board showing which accounts are behind, with automatic stop-and-alert on repeated failures.
  • Backup and restore — encrypted archives on a schedule, to a local folder or any S3-compatible bucket.
  • A bounded, encrypted message cache — bodies are kept on disk so the second read is instant, encrypted at rest by default, capped by size and age, and deleted with the account they belong to. See Message body cache.
  • Self-update from signed releases (minisign + SHA-256), or apt upgrade when you installed the package.
  • Plugins installed on demand — Cloudflare Tunnel, Tailscale, and the WireGuard engine — so the base binary stays small.

What SkimMail deliberately does not do

Knowing the edges saves you an evaluation.

  • It does not send mail. SkimMail is a reader. There is no compose window, no SMTP, and no deliverability surface to manage. This is a design decision, not a gap waiting to be filled.
  • Per-user access control arrived in 1.10.0 and took four releases to finish. Under AUTH_MODE=users each account owns its own mailboxes and cannot see anyone else's, and each user is an owner, an operator or a viewer. Create them with skimmail user add. Before 1.10.0 separate sign-ins all saw the same instance. Five operations still crossed the boundary until 1.12.0, six more until 1.13.0 — including search, which returned everybody's subjects and senders to anyone who could sign in — two more until 1.14.0, where server-side search and the account "Test connection" button would open somebody else's mailbox using that person's own saved password and network route — and one more until 1.18.0, where the Sync now button had exactly the same gap. So run 1.18.0 on any shared instance. Single-user installs were never affected. See Users and roles and Security.
  • AI features are still hidden in 1.18.0 — but hiding a button is a display decision, not a boundary. The six AI routes are in the binary and registered in every release, with no licence check on any of them; anything holding a session can call them directly, and each sends the message body to whichever provider you configure. With none configured, nothing is sent. See Security and PRIVACY.md, which corrects three claims earlier releases got wrong about this same code. AI is now the only area with no interface at all: Settings ▸ Storage became visible in 1.14.0 — the filesystem ↔ S3 blob engine with a connection test and a resumable migration, plus which database driver is active. What had kept it hidden for eleven releases was one screen beside it claiming a rebuild was needed for Postgres or MySQL, untrue since 1.4.3.
  • Reconnect every Gmail or Outlook account once, after upgrading to 1.18.0. The permissions SkimMail requested before this release were wrong for a mail server, and a sign-in granted under them cannot be upgraded in place. See Accounts.
  • Upgrade to 1.15.0 if you have run any earlier version. Up to and including 1.14.0, SkimMail's background prefetch asked the mail server for message bodies in a way that marks them read on the server — so mail you had never opened showed as read in webmail and on your phone too. 1.15.0 stops it; it cannot undo what has already happened, because there is no way to tell that mail apart from mail you genuinely read. Details: Message body cache.
  • It is not a source-available project today. SkimMail is licensed under the Business Source License 1.1 and distributed as compiled binaries. It converts to AGPL-3.0-or-later after 23 July 2030.

Editions

Community Edition is free and needs no licence key. Paid tiers raise the limits; nothing else about the software changes, and no tier ever deletes your data — going over a limit only blocks creating new accounts, connections or groups.

Accounts Sign-ins Egress connections Groups Storage
Community — free 10 1 3 2 5 GB
Sponsor 25 3 5 5 15 GB
Pro — paid unlimited unlimited unlimited unlimited unlimited

Sign-ins are the rows in users, i.e. AUTH_MODE=users. Community is one person. Sponsor's three is the smallest number at which an owner, an operator and a viewer can all exist at once. Passphrase and none mode have no rows at all — the owner there is implicit — so they read 0 of 1.

Pro also carries future access to the hosted AI Triage service, which is not part of this release.

All pages

Getting started — Installation · Configuration · The first-run setup wizard and the Setup Hub

Reference — Users and roles · Security · Operations · Troubleshooting · FAQ

Reading and triage — Search · Starred · Move to folder · Tags · Server keywords · Muted and VIP senders · Unsubscribe shortlist · Remote images in mail · Screenshot-safe mode

Setting it up and running it — Accounts · App password or OAuth? · Register the OAuth application · Account groups · Connections and per-account egress · Sync and Sync Health · Rules and signals · Notifications · Storage settings · Message body cache · Backup and restore · Remote access · Resource monitor · Plan and license

Thirty-two pages, one per feature, in each of three languages. Two features have no page on purpose: the AI tools, which are switched off in this release and are not documented until they are available to you, and per-account theme and language, which is exactly what it sounds like. The full map of page ↔ feature ↔ release lives in docs/wiki/_index.yml in the source repository.

Elsewhere

  • Downloads and release notes — GitHub Releases
  • apt repository — https://lyquyduong.github.io/skimmail/apt
  • Container images — ghcr.io/lyquyduong/skimmail
  • Reporting a vulnerability — SECURITY.md in the repository. Please do not open a public issue for a security problem.
  • Licence, tiers and trademark — LICENSE, COMMERCIAL-TERMS.md, TRADEMARK.md, PRIVACY.md

SkimMail · skimmail@base101.app · 2026-09-18 · commit f525934

Clone this wiki locally