PGP email and password-protected messages in Ayamail
Updated 30 October 2026 · 7 min read
Most of the time, ordinary email is fine. But now and then you need to send something only the recipient should be able to read: a scanned passport, a medical letter, a bank detail for a family member. Ayamail gives you two ways to do that. PGP is the long-standing open standard for people who both have keys. A password-protected message works for anyone, with nothing to install. This guide explains both, honestly, including what they do not protect.
First: how your everyday mail is protected
Your mail is protected with an encrypted connection (TLS) to and from our servers, and we require encrypted delivery from other mail servers. Mail is stored on our own servers at Hetzner in Germany. That stops people from reading your mail on the way, for example on public Wi-Fi.
Without PGP, it is not end-to-end encryption. A normal message is readable on the mail servers that handle it, ours included, and on the recipient's side. If you want a message that only the recipient can read, turn on PGP or send a password-protected message. Your files, photos, passwords and documents in Drive, Pass, Album and Docs are a different story: they are encrypted on your own device before they are stored.
What PGP is, in plain words
PGP (the open standard is called OpenPGP) gives each person a pair of keys. The public key is like an open padlock: you can hand it to anyone, and anyone can use it to lock a message to you. The private key is the only key that opens that padlock, and it never leaves your control.
When you send a PGP message, the text is locked with the recipient's public key on your device, before it is sent. Mail servers along the way, ours included, only see a block of scrambled text. Only the recipient's private key can turn it back into words. That is what end-to-end encryption with PGP means. PGP can also sign a message, so the recipient can check that it really came from you and was not changed on the way.
Because OpenPGP is an open standard, a PGP message from Ayamail can be read in other programs that support it, for example Thunderbird, the Mailvelope browser extension or another provider with PGP support.
When PGP makes sense
- You write regularly to someone who already uses PGP, such as a journalist, a security team or a developer.
- You want to be able to prove that a message came from you, using a signature.
- You want a long-term encrypted conversation with the same person, without passwords to share every time.
- If the recipient does not have a PGP key and is unlikely to set one up, a password-protected message (below) is the easier choice.
How to turn on PGP in Ayamail
PGP is included on every plan, including the free plan with 3 GB.
Open the PGP settings
In webmail or the Ayamail app, open Settings, choose Security and find the section “Encryption (PGP)”.
Create or import your key
Click “Turn on encryption” and we create a key and a strong key password for you. Save that password somewhere safe, for example in Ayamail Pass. You can also choose your own key password (at least 10 characters, with letters and numbers or symbols), or use “Import key” if you already have a PGP key.
Share your public key
Use “Copy public key” and send it to the people you want to receive encrypted messages from. They save it in their own mail program.
Add your contacts' keys
Paste a contact's public key, save it from a mail with “Save sender's public key”, or use “Find key automatically”. Ayamail then looks for a published key at the recipient's own mail domain (Web Key Directory) and on the public key server keys.openpgp.org.
Write as normal
When you have a key and Ayamail knows a key for every recipient (To, Cc and Bcc), encryption turns on by itself in the compose window. You can switch it off or on with “Encrypt message”. If even one recipient is missing a key, Ayamail tells you who and does not send the message half encrypted.
Read encrypted messages
An incoming PGP message is marked “Encrypted message”. Unlock your key with your key password and the text is decrypted in your browser or app. Your unlocked key is kept in memory for the session only and is never written to the device's storage.
What PGP does not protect
PGP is strong, but it has limits that are worth knowing before you rely on it.
- The subject line, the sender, the recipients and the time are not encrypted. That is how OpenPGP works in every mail program. Keep sensitive details out of the subject.
- Ayamail encrypts the text of the message and sends it as plain text, so formatting such as bold or images is removed.
- Attachments are not included in a PGP message in Ayamail today. To send a file securely, use a password-protected message instead.
- Each message is also encrypted to your own key, so you can read it in Sent. Your private key is stored with your account, locked with your key password. We do not know that password, so if you lose it we cannot recover your key or your old PGP messages.
- PGP protects the message, not the recipient's device. If their phone or computer is compromised, so is the message.
How Ayamail protects mail, drive and passwords
A plain explanation of TLS, PGP, password-protected messages and what is encrypted on your device.
Password-protected messages: for everyone else
Most people you write to do not have a PGP key. With a password-protected message they only need a browser and the password you give them.
Turn on “Protect with password”
Write your message as normal, with attachments if you need them, and choose “Protect with password” in the compose window.
Choose a password and a hint
The password must be at least 8 characters. “Suggest a strong password” makes one for you. The hint is optional and is shown to the recipient, so never put the password itself in it.
Decide how long it lives
The message expires after 1 hour, 1 day, 7 days or 30 days (7 days is the default). It can be opened up to 5 times, or you can tick “Delete after first read”.
Send and share the password separately
The message and its attachments are encrypted in your browser before anything is saved. The recipient gets an ordinary email with a link. Give them the password another way, for example by text message or a phone call, never in the same email.
The recipient opens it
They click the link, type the password and read the message and download the attachments in their browser. They do not need an Ayamail account or any program.
What we can and cannot see
With a password-protected message, our servers only store the encrypted content. The password never leaves your browser, so we cannot open the message. When it expires or has been opened the allowed number of times, the encrypted content is deleted from our servers.
The subject line is part of the ordinary email the recipient receives, so it is not protected. We also keep the subject and the recipients so you can see your sent messages. Replies from the recipient come back as normal email.
PGP or password: which should I choose?
Choose PGP when the recipient already has a key and you write to them often. It needs no shared secret, and it can sign your messages. Choose a password-protected message when you need to send one sensitive thing, especially with a file, to someone without PGP. It works on any device, and the message deletes itself.
If what you want is every message stored end-to-end encrypted by default, without setting up PGP yourself, a service built only for that, such as Proton Mail or Tuta, is a better fit. Ayamail is built for families and everyday use: mail, calendar, contacts and encrypted files in one account, with PGP and password-protected messages when you need them.
See all security settings
Two-step sign-in, sessions, recovery and encryption in one place.
Try PGP on the free plan
The free plan with 3 GB includes PGP. Prices for the paid plans are shown in your own currency on the pricing page.
Questions and answers
- Is all Ayamail mail end-to-end encrypted, or only PGP messages?
- No. Mail is protected with TLS on the way and stored on our servers at Hetzner in Germany, but without PGP it is not end-to-end encrypted. For a message only the recipient can read, use PGP or a password-protected message.
- Can I send a password-protected email to a Gmail or Outlook address?
- Yes. The recipient gets a normal email with a link, opens it in any browser and types the password you gave them. They do not need PGP or an Ayamail account.
- Can I use my existing PGP key?
- Yes. Under Settings, Security, Encryption (PGP), choose “Import key” and paste your private key with its password. Ayamail works out the public key from it.
- What happens if I forget my key password?
- We do not know your key password, so we cannot reset it. Without it, you cannot read PGP messages sent to that key. Store it in a password manager such as Ayamail Pass.
- Is the subject line encrypted?
- No. Neither PGP nor password-protected messages encrypt the subject line, so keep sensitive details in the message itself.
Sources
- RFC 9580: OpenPGP (IETF, July 2024) (Checked 30 October 2026)
- OpenPGP Web Key Directory (IETF draft) (Checked 30 October 2026)
- keys.openpgp.org: about the key server (Checked 30 October 2026)
- Thunderbird: OpenPGP in Thunderbird, how-to and FAQ (Checked 30 October 2026)