-
Notifications
You must be signed in to change notification settings - Fork 0
Feature Screenshot safe mode
English · Tiếng Việt · 中文
Since 1.12.0 SkimMail can substitute every identity on screen with a realistic stand-in, so you can photograph the interface without publishing your mail. It is off by default, it is a per-device preference rather than an account setting, and it changes nothing on the server.
Screenshotting a mail client is a privacy problem with no good manual answer. Blurring by hand misses the row that scrolls into view; creating a demo account gives you an empty inbox, which is exactly the picture nobody wants to look at; and proof-reading forty rows before every capture is a task nobody actually performs — least of all somebody attaching a screenshot to a bug report at the end of a bad afternoon.
Screenshot-safe mode removes the choice between "realistic" and "safe" by substituting rather than hiding. A newsletter still reads like a newsletter and a receipt like a receipt; the shape of a busy inbox survives, and none of its content does.
Settings ▸ Appearance ▸ Screenshot-safe mode. One switch, effective immediately, no reload.
A badge reading SCREENSHOT-SAFE sits at the top of the window the whole time it is on, so you cannot leave it on by accident and mistake fabricated subjects for your own mail. It can be dismissed for 60 seconds — long enough to take a capture without the badge in it — and then it comes back on its own.
| On screen | Becomes |
|---|---|
| Sender address |
sender-NN@example.com, stable per address |
| Sender display name | one of a fixed list of neutral names |
| Avatar letter | the first letter of the substituted name |
| Subject | a stand-in subject matched to the row's bundle |
| Preview line | a stand-in preview matched to the same bundle |
| Your own account address, in the sidebar and in rows | account-NN@example.com |
| Attachment names, as displayed | a neutral stem, original extension kept |
example.com is reserved by RFC 2606 for exactly this purpose, so nothing
generated here can collide with an address that exists.
Since 1.18.0, this also covers the sidebar account hover card — the popup shown when you point at an account row. Before 1.18.0 the row itself was masked but the card was not: pointing at a masked row still printed the real address, and printed it larger than the row would have shown. Fixed as part of the same release that added an optional OAuth token-validity line to that same card (SKIMMAIL-202); see Accounts for what the card shows.
The substitution is stable: the same sender maps to the same pseudonym in every row and across a reload, and each message keeps its stand-in subject. A screenshot of a busy inbox therefore still looks like one inbox rather than a crowd of strangers.
Subjects and previews are matched to the row's bundle — newsletter, transactional, notification, or ordinary mail — which is why the result reads as plausible mail instead of noise.
This is the part to read before you press the shutter. Four things stay exactly as they are, on purpose:
- Your group names.
- Tags your own rules apply.
- Server keywords, if you have those chips switched on.
- Whatever is in the search box.
Those are your words, not a correspondent's. You can rename or clear any of them in seconds, whereas vetting four thousand senders by hand is the job this mode exists to avoid. If a group is called after a client, rename it before you capture.
Two more, for different reasons:
- An attachment you download keeps its real filename, because the substitution is display-only and a file that saved to disk under a fabricated name would be this mode corrupting real work rather than protecting a picture.
- One-time codes are not detected while the mode is on. SkimMail normally surfaces an OTP it spots in a subject; here it does not look, so no live code can be printed into the image. The "OTP" chip itself still appears, so the inbox keeps its shape.
A message body is not rendered at all while the mode is on. In its place you get a short notice and some grey placeholder lines; attachments below it still render, with substituted names.
There is no partial masking of a body, and this is a deliberate refusal rather than an unfinished feature. A body is arbitrary sender-authored HTML — quoted threads, signatures, phone numbers, an address baked into an image — and any rule for hiding "the private parts" of that would be a rule that is right most of the time. A promise that holds most of the time is not what this mode is for.
The refusal covers the reading pane, Peek (space) and Focus mode (f) alike.
The preference lives in the browser, next to your theme choice. It is not tied to your account and does not sync.
That is the right shape — whether you are about to take a screenshot is a fact about you and the machine in front of you, not about your account — but it has a consequence worth stating plainly: turning it on for your laptop does not turn it on for your phone. If you capture from a second device, switch it on there too. A private-browsing window that cannot write to local storage keeps the setting for that session only.
It is also not a release feature flag, so no upgrade will turn it on or off for you.
| Available since | 1.12.0 |
| Default | off |
| Scope | one browser on one device |
| Distinct sender pseudonyms | 48 |
| Distinct display names | 16 |
| Stand-in filenames | 8 |
| Stand-in language | English only |
- The stand-in corpus is not translated, whatever language the interface is in. It is stage dressing for a picture, not product copy, and one corpus is one thing to keep safe instead of three.
- With more than 48 correspondents on screen, two of them will share a pseudonym. That is a cosmetic collision, not a leak — nothing about the real addresses can be recovered from it.
- It does not change or send anything. Nothing is written to the database, no request leaves the browser because of it, and switching it off restores the real values instantly. Every click still acts on the real message.
- It is not redaction of an exported file. It substitutes what is drawn on screen. A screenshot is safe; a database dump, a log file or a backup archive is completely untouched by this setting.
- It is not access control. Anyone who can reach the interface can turn it off again. For keeping mail away from other people, see Users and roles and Security.
- It does not hide the fact that mail exists — counts, dates, unread state and the general shape of your inbox are all still visible, and that is the point of taking the screenshot in the first place.
- Security — the threat model this sits inside
- Users and roles — keeping mail away from other people rather than away from a camera
- Server keywords — the other per-device preference added in 1.12.0, and one of the things this mode does not substitute
SkimMail · skimmail@base101.app · 2026-09-18 · commit f525934