We’re excited to announce that Skiff Mail’s entire client code

 – including web, iOS, Android, and Desktop apps – will be completely open source at 

Starting today at launch, anyone will be able to check out the product codebase - understanding and ensuring how all data on Skiff Mail is completely end-to-end encrypted before ever leaving your device. We’ve also updated our 

 to provide a detailed overview of Skiff Mail’s technical architecture and underlying cryptographic protocols.

We have been committed to open source software since the very beginning of Skiff. We strongly believe that privacy cannot be just a promise; software must be available for anyone to independently audit and validate.

In addition to Skiff Mail, we’ve already open sourced our component library (

 Skiff as our ecosystem of products grows.

As developers, we love working closely with the open source community. You can join our 

 to submit questions, suggest contributions, or just share what you’re working on. We will also be regularly updating the 

 repo to stay in-sync with the live version of the app.

We believe that open sourcing is an essential part of building trust

 around secure products. As a first step to completely open sourcing Skiff, we're sharing two key components of the Skiff codebase: our typed-AEAD envelope and UI component libraries.

As we scaled out our platform, it became important to be able to inspect metadata without having to decrypt objects. This would both save compute and prevent decryption of badly-formatted data.

Our authenticated encryption with associated data (AEAD) envelopes library allows us to embed additional information in the output of encryption functions. While the nacl family of envelope functions (e.g. secretbox) only support encryption-related metadata (e.g. nonces), our library is more extensible. We currently use our AEAD library at Skiff to validate data versions and types.

Skiff UI is a react components library for the Skiff UI Design System. It's currently in-use almost everywhere on our app. Over time we plan to continue adding more security and privacy-focused components to the library. Our hope is that Skiff UI will be able to spread usability to security products more widely.

The two libraries can be accessed at the following links: 

. We're releasing them under the GNU AGPLv3 license.

We look forward to having more eyes on our codebase, and appreciate any feedback. If you have any questions or ideas, feel free to reach out to us at hello@skiff.org.

Skiff is Open Sourcing

: Privacy-first, end-to-end encrypted, open-source, Web3-native email.

Skiff Mail is built to be the next generation of email. Since the mid 1990s, email has brought an unprecedented degree of collaboration to the world - allowing scientists to share research, families to stay in touch, and the professional world to function.

Yet even as email has been adopted by billions of individuals, most large mail providers still have woeful privacy protections — allowing users’ messages to be read, processed, and stored by third parties.

Skiff Mail shifts the paradigm with simple and intuitive privacy. Skiff never stores unencrypted copies of any messages sent on Skiff Mail - and every Skiff-to-Skiff messages is end-to-end encrypted. Sign up, log in, and every message you send is owned by you.

Privacy applies beyond messages sent to and from Skiff Mail. Every message received from an external, third-party mail provider is immediately encrypted - ensuring only users have access to unencrypted copies of their emails.

Open-sourcing has always been a central piece of our strategy at Skiff, allowing us to build trust with our community and deliver transparent and trustworthy privacy. This is why we have decided to open-source the entire Skiff Mail product on launch. Visit 

Skiff Mail is also Web3 native. Sign up for Mail with a crypto wallet (currently MetaMask and soon Brave Wallet) to collaborate while completely owning your data. Just like Skiff's Workspace product, users have the option to store data on Protocol Labs' decentralized storage network IPFS, and also to send emails to/from their ENS addresses.

To use Skiff Mail, sign up for a Skiff account at 

Skiff Mail features instant, privacy-preserving search. Full text search has been a key feature in Skiff’s collaboration platform - allowing you to search through workspaces containing thousands of files instantly. We have brought this search function to Skiff Mail, allowing for message, subject, to/from/cc search, and more. Skiff’s search is completely open source - read more about Skiff search on 

Mobile and desktop apps for sending, receiving, and notifications are crucial for using email. Skiff Mail launches with fully featured mobile apps for iOS and Android as well as a fully featured macOS desktop app. Check them out below:

Skiff Mail lets you sign in, send, and receive mail using a crypto wallet. For the first time, send directly to an ENS address using Skiff. Read more about our wallet integration on Skiff’s 

Every Skiff Mail user receives 10 GB of free storage to send and receive mail and attachments. As we transition out of Skiff Mail Alpha into future versions, we’ll support additional storage and paid plans.

Introducing Skiff Mail

 in the 1960s and 1970s, computer scientists and mathematicians have proposed numerous methods for adding encryption and safeguarding email content from unwanted third parties.

Every email user - from Fortune 500 Companies to individuals - has valuable and sensitive data contained within their inbox. Email encryption is a critical and necessary solution for those users and organizations who want to protect their data while continuously seamlessly with other parties.

Furthermore, organizations that use various email encryption techniques gain needed competitive advantages over those that do not. For example, as companies work across borders, timezones, and nation states, email encryption ensures that trade secrets and sensitive data, like client information or financial records, are protected and secure at all times, even across different network providers and internet providers.

At its most basic technical level, email encryption works using a cryptography where one party generates a public key and a private key. Public key encryption, also known as asymmetric key encryption, is a type of encryption that uses these two different keys - a public key and a private key - to send data securely to another party. While the public key can be shared with anyone and is not considered sensitive information, the private key must be kept secret. When data is encrypted with the public key, it can only be decrypted with the private key. As a result, it is impossible for someone who does not have the private key to decrypt data, even if they have the public key.

This technique is clearly accessible to the email encryption paradigm, as an individual or organization’s public key can be shared widely and used to encrypt email content. Then, once encrypted, only the private key holder can decrypt and view sensitive data.

Unsurprisingly, malicious actors, such as cyber criminals and hackers, typically target and attack unencrypted emails. This sort of attack is impossible when you are using encrypted email as the email content is completely obscured.

Beyond simple email encryption, end-to-end encryption ensures that 

, not even an email service provider, can access your email content, subject, or other information.

End-to-end encrypted email providers, such as Skiff.com, offer a number of security benefits for protecting sensitive data. We will discuss some of these benefits below:

From financial records and intellectual property, to company transactions and trade secrets, encrypted email ensures that your data is secure and safe from exploitation.

If your company operates in an industry that requires sensitive client data handling, such as companies in the finance, legal, and health sectors, keeping your emails encrypted is a necessity. Email encryption not only protects your clients data, but also protects your firm from lawsuits, fines, and the reputational damage that a breach of your emails could cause.

Hackers and cybercriminals are coming up with increasingly sophisticated ways to intercept and decode corporate sensitive information. Generally, it should be assumed that malicious parties can easily access unencrypted emails and steal information transmitted without encryption through networks. Email encryption is an efficient and easily implemented solution to this.

On a similarly damaging level, unencrypted emails or messages can be altered and modified by malicious parties after they are sent. Malicious parties could save, share, or even re-send these emails later, possibly containing a virus. These malicious emails could subsequently infect colleagues’ computers, friends’ inboxes, or - in the worst possible scenario - client network infrastructure. All parties sensitive and personal data could be compromised.

Email encryption helps prevent these attacks with built-in timestamps and using random session keys. Encrypted email providers, such as Skiff, may also allow you to add one-time passwords, which are discarded after use.

Identity theft involves a malicious party stealing sensitive information to take control of your legal identity. This party may then use your identity to commit scams or financial fraud. When attackers compromise your emails, they are frequently able to gather enough personal information to commit identify theft and possibly steal your money, assets, or other valuables.

Identity theft is yet another reason why you and your business should opt for an encrypted email provider.

Adding additional authentication to emails can help distinguish between real legitimate emails versus spam or phishing emails.

Email authentication uses digital signatures to protect confidential data; these signatures are unique and come with specific codes for different users. Most encrypted email providers will have multi-factor authentication as an additional feature, either on user accounts or on individual messages.

Email encryption protects your data by ensuring that no additional parties can access, exploit, or abuse critical information. From preventing identity theft to securing your data from network monitoring, email encryption is an absolute must today.

Email encryption keeps your data safe and protects sensitive and valuable information from cyber-criminals. Beyond simply safeguarding your data, email encryption also protects you and your contacts from identity theft and other malicious activities.

If you want to protect your business from these critical risks, 

 can help. We provide email, document, and file encryption products that keep your email and company’s data end-to-end encrypted and private only to you.

The Security Benefits of Encrypted Email

Whether for work-related issues, academic tasks, or even personal errands, we constantly rely on email to make collaboration and communication easy as possible, even across long distances and timezones. Many of us keep financial statements, medical records, and family pictures stored within our emails. Keeping our email addresses safe and secure is a number one priority in the modern world.

Many people do not consider email security in their daily communication routines. But - what are the consequences if your emails are not safe and protected? Are you risking valuable and sensitive information by not taking sufficient security measures?

We want to make sure you are taking all the right precautions to keep your emails safe. As a result, we made a list of best practices for individuals and businesses to protect the sensitive and personal information stored in the tens of thousands of emails in your inbox.

Email security is a variety of technical techniques and good-practice procedures for preventing your inbox and address from being exploited by anyone. Theoretically, a hacker with access to your inbox could steal your personal information or could use your email address to spread viruses, spam, malware, and ransomware to your immediate contacts.

Organizations frequently send tens of thousands of emails per day, and confidential data is almost always involved. If a third party or an outsider were to gain access to this data, it would cause a severe and possibly existential incident for a company.

Encrypted Email: Best practices for Businesses and Individuals

To keep your emails safe and secure, we recommend adopting some or all of measures outlined below. Every measure is carefully crafted to avoid different forms of risk, from your device being compromised to someone figuring out your password.

Unfortunately, it may not surprise you that passwords like “abcdef,” “123456,” or “password” remain common today. Unsurprisingly, these passwords are not strong and easily guessed through trial and error.

Yet, even with knowledge of these risks, many of us use easily guessed passwords. Attackers looking to access your inbox can use software to test these passwords and gain access in seconds.

On the other hand, strong passwords are significantly harder to guess and prevent even more sophisticated software from being used to gain access. A strong password includes a combination of numbers, special characters, and upper and lower case letters. Using phrases instead of words is also highly recommended. You should also avoid using your birthday or any ID of your passwords.

Even beyond email, using strong passwords is a must: Figuring out a password is a first line of attack for malicious attackers. Furthermore, once one account is compromised, it can compromise additional parts of your digital life, particularly if you use the same password multiple times. If you want to keep your accounts safe, you need to have a strong password for your email account.

Multi-factor authentication (MFA) is another critical line of defense to protect your inbox and communications from hackers or unauthorized access. MFA even prevents attackers who know your password from logging into your email account.

When multi-factor authentication is set up, every time someone tries to log into your account a code is sent to your phone, an authenticator app, or another device to verify it is really you trying to log on. A potential attacker would not only need your password but also one of your devices to log in to your account.

Almost all email service providers offer two or multi-factor authentication to provide a safer platform for their users. MFA’s main benefit is that a potential intruder cannot enter your system until they get their hands on the code you received when attempting to log in. These multi-factor authentication codes usually come in the form of SMS, calls, or alternate emails.

Multi-factor authentication is a necessary form of email security and makes data theft significantly harder for any potential adversary.

A phishing attack is when a potential attacker sends you a fake email and tries to trick you into clicking a link or opening an attachment containing malicious software. They could also try to trick you into entering your username and password on a fabricated link or website.

Phishing emails can claim to be from “legitimate” sources like Paypal or your bank. If you end up giving your personal information in a phishing attack, change your passwords immediately and contact your bank or financial provider.

Furthermore, we recommend always blocking and reporting email addresses that send you phishing emails. This protects you and others from becoming victims of phishing attacks.

Everyone loves free Wi-Fi. However, connecting to free and public Wi-Fi can expose you to potential attacks and threats. These public networks are unsafe as network traffic could be monitored. Even if you use a strong password, hackers could monitor traffic to certain websites and compromise your inbox or other online accounts.

If you need internet outside your home or workplace, you should try using your cellular data or purchase a portable WI-FI router if needed. Using public networks may invite intruders to access your data and passwords.

If you have connected to public networks recently or think you might have clicked on a suspicious link, you should immediately consider updating your passwords. This could be essential in keeping your online information safe.

Changing passwords will ensure security and peace of mind in these scenarios. Furthermore, if an old password is compromised but you change passwords frequently, potential intruders can still be kept at arms length. Password managers are particularly useful for changing and updating passwords.

6. Be careful using public or shared devices

Most public or shared devices can save your login information without you realizing. Some of them remember what the user last typed in a login field, so anyone who uses that device after you may have access to your information.

Be careful when you use public or shared devices and make sure you do not enter your email and password unless absolutely necessary.

This is one of the most effective security practices that you should follow. Ensure you log out of your email and remove saved usernames and passwords before leaving a public device, or leaving your personal devices open in public. Log out of all accounts, especially your email.

Leaving your email logged in on an unfamiliar device is like leaving the keys to your house at the front door.

Sometimes a harmless file you are expecting to receive actually contains malicious software. Unfortunately, it is frequently very difficult to discern the difference between a completely harmless file and one that contains a computer virus. If you were to accidentally open a file containing malicious software, your email and data could be exposed and accessible to hackers.

Once you have let malicious software infect your computer or device, your options are limited (even changing your password could leave your account exposed). This is why cybersecurity experts recommend scanning files before opening them and making sure you trust the sender.

There are many security tools on the market that can protect your email and catch files with viruses before they spread to the rest of your computer or device.

This is an essential step in email security, monitor your email activity and login sessions. If you work in an organization and check your mail regularly, you need to monitor login activity.

Look out for websites and newsletters you subscribe to, the number of emails you send and receive per day, and the time you spend on email threads other than one that your organization sends.

10. Try a fully end-to-end encrypted email provider

If you want to keep your email as safe, secure, and private as possible, you can look into creating an email account with a provider that offers full end-to-end encryption. End-to-end encryption ensures that only you and the other recipient are the only two people who will have access to the contents of your email.

If any attacker tries to intercept your emails at any point, they will not be able to access any of your information or email data.

We have discussed best practices that both businesses and individuals can leverage to keep their sensitive data and information safe and protected from unauthorized users. These practices help keep you and your business secure and avoid costly or embarrassing breaches.

Knowing that email is an essential way to communicate with other people, we recommend using 

, which provides fully end-to-end encrypted email for businesses and professionals who want to keep all data secure.

Encrypted Email: Best Practices for Businesses and Individuals

The Node.js crypto library is a built-in module that provides cryptographic functionality for Node.js applications. It includes a range of features, such as support for generating cryptographic keys, encrypting and decrypting data, and creating and verifying digital signatures.

The Node.js crypto library uses the same cryptographicalgorithms and protocols as other secure systems, which ensures that the cryptographic operations it performs are just as secure. It also includes mechanisms for ensuring the integrity of cryptographic operations, such as support for digital signatures.

The Node.js crypto library is easy to use and can be integrated into Node.js applications with just a few lines of code. It is widely used in the Node.js community and has become an important part of the Node.js ecosystem.

Overall, the Node.js crypto library is a valuable tool for Node.js developers who need to perform cryptographic operations in their applications. It provides a range of features and is easy to use, making it a popular choice for implementing cryptography in Node.js applications.

To start, you will need to have Node.js installed on your system. You can download the latest version of Node.js from the official website (

Once you have Node.js installed, you can use the following steps to encrypt and decrypt a message using the Node.js crypto library:

1. Create a new Node.js project by running the following command:

2. Create a new JavaScript file, named app.js, and add the following code to import the Node.js crypto library:

3. Add the following code to generate a random encryption key:

4. Add the following code to define the message that you want to encrypt:

const message = 'This is the message that we want to encrypt.';

5. Add the following code to encrypt the message using the encryption key that you generated previously

const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);

let encrypted = cipher.update(message, 'utf8', 'hex');

6. Add the following code to decrypt the encrypted message using the encryption key that you generated in step 4:

const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);

let decrypted = decipher.update(encrypted, 'hex', 'utf8');

7. Add the following code to print the encrypted and decrypted messages to the console:

console.log('Encrypted message:', encrypted);

console.log('Decrypted message:', decrypted);

8. Run the following command to execute the JavaScript file and encrypt and decrypt the message:

If everything works correctly, you should see the encrypted and decrypted messages printed to the console.

WebCrypto is a standard for implementing cryptographic operations in web browsers. It provides a set of APIs (application programming interfaces) that enable web applications to perform cryptographic functions, such as encrypting and decrypting data, securely.

One of the key reasons why WebCrypto makes browser cryptography secure is that it uses the same cryptographicalgorithms and protocols that are used in other secure systems. This ensures that the cryptographic operations performed by web applications are just as secure as those performed by other applications.

Additionally, WebCrypto uses a secure environment to perform cryptographic operations. This means that the cryptographic keys used by web applications are not accessible to other parts of the browser, or to other applications on the user's device. This helps protect against attacks that try to steal cryptographic keys or other sensitive information.

Furthermore, WebCrypto includes mechanisms for ensuring the integrity of cryptographic operations. For example, it includes support for digital signatures, which can be used to verify that a message or other data has not been tampered with. This helps protect against attacks that try to alter the results of cryptographic operations.

Overall, WebCrypto makes browser cryptography secure by using strong cryptographicalgorithms and protocols, providing a secure environment for performing cryptographic operations, and ensuring the integrity of cryptographic operations. These features help ensure that web applications can perform cryptographic functions securely and reliably.

To use WebCrypto, you will need to include the crypto object in your code. This object contains several methods that you can use to perform cryptographic operations, such as generating keys, encrypting and decrypting data, and signing and verifying data.

Here is a simple example of how to use WebCrypto to generate a random key and encrypt some data:

const key = crypto.subtle.generateKey( { name: "AES-GCM", length: 256, }, true, ["encrypt", "decrypt"] );

const data = new TextEncoder().encode("Hello, world!");

const iv = crypto.getRandomValues(new Uint8Array(12));

const encryptedData = crypto.subtle.encrypt( { name: "AES-GCM", iv: iv, }, key, data );

In this example, we first import the crypto object, which provides access to the WebCrypto API. We then use the generateKey method to generate a random AES-256 key that we can use to encrypt and decrypt data.

Next, we create a TextEncoder object, which we can use to convert a string into a Uint8Array of bytes. We then use the encode method to encode our string as a Uint8Array.

Finally, we use the encrypt method to encrypt our data using the key and an initialization vector (IV). The IV is a random value that is used to ensure that the encrypted data is unique for each encryption operation.

This is just a simple example of how to use WebCrypto. There are many other cryptographic operations that you can perform using this API, such as generating hashes, signing data, and building applications that rely on client-side crypto, such as Skiff’s suite of end-to-end encrypted 

Here at Skiff, we've open-sourced and MIT licensed our own, easy-to-use JavaScript encryption, decryption, and object versioning library. You can check out the library 

Skiff-crypto is designed to be functional, powerful, and easy-to-use. To encrypt and decrypt text, all you have to do is:

const skiffCrypto = require('@skiff-org/skiff-crypto');

const plaintext = "Hello, skiff-crypto!";
const keypair = skiffCrypto.generatePublicPrivateKeyPair();
const encrypted = skiffCrypto.stringEncryptAsymmetric(keypair.privateKey, { key: keypair.publicKey }, plaintext);

const decrypted = skiffCrypto.stringDecryptAsymmetric(keypair.privateKey, { key: keypair.publicKey }, encrypted);

console.log('Ciphertext:', encrypted);
console.log('Expected to be true:', plaintext === decrypted);

You'll find a suite of functions for encoding or decoding strings into byte arrays, object datagrams for managing versions and structure, and functions for generating and verifying signatures.

Hashing is the process of taking a piece of data and converting it into a fixed-size string of characters, known as a hash. Hashes are often used to store passwords because they are secure and difficult to reverse.

To create a hash in JavaScript, you can use the crypto library, which is built into modern browsers. Here is an example of how to create a hash using the crypto library:

const crypto = require('crypto'); // Create a hash

const hash = crypto.createHash('sha256'); // Update the hash with the data you want to hash

hash.update('my-data-to-hash'); // Get the final hash as a hexadecimal string

console.log(hashString); // Outputs a long string of characters

In this example, we use the sha256 algorithm to create the hash. This is a popular and secure algorithm, but there are many others to choose from. You can see a full list of supported algorithms by calling crypto.getHashes().

Encoding is the process of taking data and converting it into a different format. This is often used when storing or transmitting data, as different formats can be more efficient or secure.

In JavaScript, you can use the Buffer class to encode data into a variety of formats. Here is an example of how to encode data as a base64 string:

const buffer = Buffer.from('my-data-to-encode'); // Encode the data as a base64 string

const encodedString = buffer.toString('base64');

console.log(encodedString); // Outputs a base64-encoded string

In this example, we use the Buffer.from() method to create a Buffer object storing the relevant data. Then, we instruct the Buffer to convert the data to a string in base64. From there, the encoded output is printed to the console.

Other crypto libraries in Javascript, such as 

, simplify some of the interfaces and functions needed. For a tutorial on how to use this library, check out 

What products use cryptography in JavaScript?

Crypto libraries for the web and NodeJS have enabled a new generation of privacy-first web development. A few of our favorite examples are below:

 is an end-to-end encrypted, private workspace, with products for email, calendar, collaborating on notes, and file storage. The product performs key pair generation in the web using elliptic curves. Using asymmetric cryptography, Skiff Mail encrypts messages with recipients’ public keys such that only users’ individual private keys can decrypt messages and see the resulting plain text. Skiff Mail is free to use, with 10 GB of storage included, and offers paid plans for custom domains, extra storage, and business features.

MetaMask is a free, open-source crypto wallet. It performs all key derivation inside the app itself (which, for web users, can be a browser extension on Chrome, Firefox, or other apps), keeping a user’s secret keys stored locally. MetaMask offers extensive 

 on its encryption standards, APIs, and security.

A password manager uses encryption to protect the sensitive data it stores, such as login credentials and other personal information. When a user saves a new login to the password manager, the software encrypts the data using a strong encryption algorithm. This ensures that even if someone were to gain access to the password manager's database, they would not be able to read the stored information without the proper decryption key - they would only be able to access encrypted ciphertext. The password manager also typically encrypts the user's master password, which is used to access the stored login credentials, for added security.

How can you do cryptography in Javascript?

 problems in computer science. From basic problems, like checking whether one value exists in a long list of items, to mapping routes from offices to home addresses, search algorithms have led to enormous innovation in data structures, algorithms, and optimization.

On the largest scale, algorithms may process search terms that require indexing and tracking the entire internet (such as 

), or indexing volumes of user data across millions of documents, emails, and messages.

This blog will begin by outlining how traditional search algorithms work, including some basic algorithms for processing data. Then, we’ll give a brief overview of how search algorithms work on user data in search providers as well as common consumer products, such as Gmail and Microsoft Outlook. Finally, well explain how new and innovative algorithms allow for searching through data - even end-to-end encrypted data completely private to service providers.

How do traditional search algorithms work?

Search algorithms are the heart of every search engine. Without them, we would be lost in an ocean of unstructured data with no way to find the information we need. Search algorithms are designed to take a set of data and optimize to find the most relevant content for a given search query. All operate on massive datasets consisting of the world’s information, from news articles to Wikipedia pages.

The most popular search engine algorithm is Google’s PageRank. 

 was developed by Google co-founder Larry Page. It looks at the link structure of the web to determine which pages are most important. The more links a page has, the more important it is. There are now many other important factors in ranking, however, such as the freshness of content and the number of searches for a particular term. Google’s algorithm is constantly changing to give users increasingly relevant results.

Microsoft’s Bing uses a different algorithm called the Bing Webmaster 

. This algorithm looks at many factors, including the quality of a website’s content, its design, and how easy it is to use. Yahoo! uses a combination of human editors and algorithms to create its search results. The company’s search engine was once the most popular, but it has since fallen behind Google and Bing.

Algorithms are also used to index content so it can be searched. When you search for a term on a search engine, the results are organized by how relevant they are to your query. The relevance is determined by algorithms that look at the content of the pages and how often the search term appears. The most important part of a search algorithm is the ranking function. This is the part of the algorithm that decides which results are the most relevant. The ranking function looks at a number of factors, including the number of times the search term appears on the page and the location of the term on the page.

Some consumer products, such as Gmail and Outlook, form “boolean” indices of user data, where boolean true or false values are used to indicate the presence or absence of a particular term in a certain document. In this context, a document could be any piece of structured content, such as an email, a webpage, or an actual file.

Search engines are constantly tweaking their algorithms to try to improve the quality of their results. They are also working on ways to index more content so that people can find what they’re looking for more easily. As more and more content is created, the algorithms that index and rank it will become more important. They will play a vital role in helping people find the information they need.

Searching encrypted data is challenging because the data is not in plaintext and instead in a completely unreadable format. This makes the algorithms described above impossible to apply effectively.

Instead, the data is stored as ciphertext, which is unreadable without access to a symmetric or asymmetric encryption key, depending on the context and algorithm used. As a result, keyword search using algorithms similar to how Google, Yahoo, and Bing index content would be completely useless.

This leaves two options: Indexing and searching when data is decrypted, such as on a user’s device, or using advanced algorithms for searchable encryption. Searchable symmetric 

 requires one participant to process and encrypt data in a way that allows for it to be searched over later. More advanced research in this area includes homomorphic 

, which outlines cryptographic algorithms for performing computations, such as search, over encrypted data.

Currently, indexing and searching through data while decrypted, such as on a client device, is the most practical and simplest. Below, we’ll walk through a few examples of products that leverage client-side search algorithms.

New products have started to implement search algorithms that index data client side. This presents multiple tradeoffs: Generally, client-side search can be faster and more reliable, but it is also costly to sequence and index user data on a device instead of in the cloud. This price yields significantly greater privacy.

 feature indexes all searchable data on a user’s computer, from files to applications. It sorts this data into an easily searchable format that can then be used to surface results of many different types.

 is an end-to-end encrypted, privacy-first email and collaboration workspace. Because all data is stored end-to-end encrypted, and unknown to Skiff, it must be searched on users’ devices. This allows for easy-to-use, user-friendly search while maintaining complete data security.

, we walk through even greater technical detail on how Skiff’s search algorithms work. Check out some of our open-source search indexing on the Skiff 

Skiff Mail is Open Source

Related articles

Join the community