TL;DR: AurionMail Suite delivers a Proton-like user experience by combining proven technologies such as CryptPad, Bulwark Webmail, Stalwart Mail Server, Ory Hydra, and OpenPGP.
CryptPad is a powerful collaborative suite, but email falls outside its core scope. Consequently, using encrypted documents alongside encrypted emails traditionally requires managing two separate accounts and passwords.
AurionMail acts as the orchestrator linking CryptPad and a JMAP-based email service into a single, unified workflow.
Users only need to remember one single password to encrypt and decrypt both their emails and CryptPad documents. You enter it once per session to access CryptPad, the webmail, or both.
Additionally, we refreshed CryptPad's UI to provide a modern, cohesive look and feel across the suite.
Existing privacy solutions usually force a compromise between user experience, self-hosting control, and open standards.
Commercial suites offer a seamless single-password workflow, but their backends remain closed-source. On the other hand, self-hosted alternatives often fragment the user experience, requiring users to manage separate accounts and passwords for email and document collaboration.
AurionMail Suite bridges this gap by delivering the smooth Zero-Knowledge experience of commercial platforms on top of a 100% open-source, standards-compliant, self-hosted stack.
| Feature | Proton Suite | Nextcloud + Mail | Standard CryptPad | AurionMail Suite |
|---|---|---|---|---|
| 100% Open Source & Self-Hosted | ❌ (Proprietary backend) | 🟢 Yes | 🟢 Yes | 🟢 Yes |
| E2EE Email & Documents | 🟢 Yes | 🟡 (Complex / Plugin-based) | ❌ (No built-in email) | 🟢 Yes |
| Unified Identity & Encryption (1 Password) | 🟢 Yes | ❌ (Fragmented SSO / Manual PGP) | ❌ (Docs-only account scope) | 🟢 Yes |
| Open Standards (OpenPGP, JMAP) | 🟡 (OpenPGP supported, limited key discovery) | 🟢 Yes | ❌ (N/A for email) | 🟢 Yes |
CryptPad excels at secure document collaboration but lacks email. AurionMail extends CryptPad with a fully integrated, E2EE JMAP email client—sharing the same single Zero-Knowledge password so users don't have to manage two isolated systems.
Nextcloud Mail is a standard IMAP client that relies on browser extensions (like Mailvelope) and manual PGP key management for end-to-end encryption. AurionMail delivers seamless, out-of-the-box Zero-Knowledge encryption without complex user workflows.
Proton offers a smooth single-password experience, but its backend is closed-source and locks you into their cloud. AurionMail gives you that exact same seamless user experience on a 100% open-source, self-hosted stack built on open standards.
- Single Password Encryption: Authenticate and encrypt all user data with one master password.
- Single Logout: Logging out from either Webmail or CryptPad automatically logs you out across the entire session/device.
- Global Logout ("Logout from all devices").
- Password change Change your master password without loosing your data.
- Key Synchronization: Seamless key syncing across authorized user devices.
- Core Integrations: Full feature sets inherited from underlying services (CryptPad, Bulwark Webmail and the PGP E2E Plugin for Bulwark).
- Account install : You can create users in LDAP with your workflow and give them a temporary password. Users then visit sso.domain/init to create their master password and activate their account.
- Emergency Account Hold: A secure URL generated at account creation that disables the account if accessed (protecting data if a master password is compromised).
- Emergency Account Destruction: A secure URL that permanently destroys the account and its associated keys if visited.
 |
 |
| Login – Login page. | Logout – Logout page. |
 |
 |
| Bulwark's Aurion Plugin – Manage keys, change password, with the Aurion Plugin. | Email Encryption – Send encryptped emails to your contacts. |
 |
 |
| Cryptpad Drive – Cryptpad is integrated with a refreshed and modern UI | Cryptpad Settings – You can still edit your cryptpad settings. |
Here is how the components fit together. Items highlighted in bold are built by the Aurion team:
- LDAP: User management (Identity Source of Truth).
- Ory Hydra: SSO OAuth2/OIDC backend handling authorization flows.
- SSO Web App: Frontend for authentication and Zero-Knowledge key derivation.
- Stalwart Server: High-performance JMAP mail server backend.
- Bulwark Webmail: Webmail frontend interface.
- Bulwark PGP Plugin: Extension enabling end-to-end OpenPGP mail encryption.
- Core-API: Central server managing key sync, session state, and inter-app communication.
- Bridges: Lightweight bridge scripts handling secure secret sharing during login/logout routines.
- CryptPad (Customized): Integrated with an SSO plugin and custom styling for a unified UI.
AurionMail is a distributed suite. However, you can use Orchestra to get a single binary covering
- Hydra
- SSO
- Bulwark
- Core API
- Bridges
- Cryptpad Customized
See Installation Guide for more details.
Explore the individual sub-modules of the project:
Are you a system administrator looking to test AurionMail? Check out the Installation Guide.