Overview
Mailum positions itself as a no-KYC encrypted email service built for users who refuse to trade identity for communication. Launched by figures with ties to the defunct OpenMailBox project, the platform promises full-stack encryption, not merely message bodies, but subjects, sender and recipient fields, timestamps, and metadata all get wrapped in cryptographic protection. The service operates on a zero-knowledge architecture, meaning Mailum's servers cannot decrypt user correspondence even if compelled. With Tor-native access, open-source code, and pseudonymous signup, Mailum targets the privacy-conscious segment that ProtonMail and Tutanota have long contested. However, its overall score of 6/10 and extremely low trust metrics suggest significant caveats beneath the marketing veneer.
Privacy & KYC
Mailum sits at KYC Tier L1, Anonymous, the most permissive classification in our directory. Registration demands no personal data, no phone verification, and no identity documents. Users can access the service through a standard web browser or via its Tor onion mirror, hiding even the fact that they use an encrypted email provider from network observers. The provider claims no IP logging, no ads, and no trackers, policies that, if faithfully executed, would place it among the leanest privacy commitments in the email space.
Yet the picture fractures under scrutiny. Community reports indicate VPN blocking that undermines anonymous access, directly contradicting the service's privacy positioning. Multiple users note that free accounts cannot send emails to external addresses or reply to non-Mailum senders, rendering the tier functionally hobbled for real-world use. Most alarmingly, ScamAdviser assigns Mailum a trust score of 0, citing phishing reports, suspicious IPQS flags, and a registrar with elevated spammer association. Reddit's 2025 ban of r/Mailum, archived in a dedicated GitHub repository by the team, further clouds the reputation landscape, though the stated rationale remains opaque.
- KYC requirement: None (pseudonymous)
- IP logging: Claimed no-logs policy
- Tor support: Native onion service available
- Third-party trust signals: Strongly negative (ScamAdviser, IPQS)
Supported assets & payments
Mailum accepts an unusually broad payment spectrum for an email provider, reflecting its crypto-native ethos. Users can settle subscriptions with Monero (XMR), Bitcoin (BTC), and Lightning Network transactions, preserving financial privacy alongside communication privacy. Fiat and cash options also appear in the accepted methods list, though specific processors and regional availability remain unspecified in available sources. This multi-asset flexibility aligns with the no-KYC philosophy, Monero in particular offers transaction unlinkability that complements pseudonymous account creation.
Security & custody
Mailum's security model centers on zero-knowledge encryption with native PGP support. The platform encrypts the entire email envelope, body, subject, sender, recipient, and metadata, using what third-party reviews describe as advanced end-to-end schemes. Users control decryption keys locally; password recovery without a pre-generated Secret Token file results in permanent message and contact deletion, confirming that Mailum cannot facilitate law enforcement decryption.
The open-source codebase allows technical audit, though independent security assessments are not prominently documented. Hardware security token support (YubiKey, U2F) appears in some coverage, suggesting multi-factor authentication options. However, the privacy score of 0/100 and trust score of 4/100 in our internal metrics, driven by external scam reports, VPN blocking behavior, and platform moderation controversies, indicate that architectural soundness does not translate into operational confidence. Users must self-custody their Secret Token and accept irreversible data loss if credentials are misplaced.
Who it's for, verdict
Mailum serves a narrow, technically adept niche: users who prioritize anonymous email access, accept cryptocurrency payments, and can tolerate significant usability friction. The full-stack encryption and Tor integration genuinely advance beyond many competitors' body-only protection. For journalists, activists, or researchers in high-surveillance regions, these features may outweigh drawbacks, provided they pay for a functional tier and verify the onion mirror independently.
We cannot broadly recommend Mailum to typical privacy seekers. The free version's sending restrictions make it impractical for daily use, while the abysmal external trust scores, VPN blocking, and platform ban history create red flags that no open-source claim fully neutralizes. Users comfortable with ProtonMail's moderate KYC or Disroot's community provenance will likely find more reliable alternatives. Mailum remains an interesting but unproven experiment in maximalist email privacy, worth monitoring, but risky to depend upon for critical communication in 2026.
