Security

Google's own warning about tools like this is fair: Exercise caution with these services, as they often require access to your email credentials or OAuth tokens. (Gmail Help 17101213). SendAs Relay needs your other address's SMTP password to send as it. This page says exactly where that password goes.

The short version

Your passwords are stored only in your browser. There is no SendAs Relay account and no server-side copy.
When you send, the message and that address's login go to the relay over HTTPS, for the one connection to your provider. The relay stores nothing and logs nothing.
The relay is open source (MIT). You can read it and run your own copy for free, so your passwords never touch our infrastructure.

Where your passwords live

What	Where	Protection
SMTP passwords for your addresses, Gmail app password for Sent copies	Extension storage in your browser profile (`storage.local`)	Optional passphrase: AES-256-GCM, key from PBKDF2-SHA-256 with 600,000 rounds and a random salt
Unlocked key (only with a passphrase)	Browser session memory (`storage.session`)	Cleared when the browser closes, or after 15 minutes, 1 or 4 hours unused, as you choose
Addresses, server names, settings	Extension storage	Not secret; never leaves your browser except the server name and username sent with each message

The Gmail page never sees your passwords. The part of the extension that runs inside Gmail only knows your addresses. Passwords are read by the extension's background script, which is the only part that talks to the relay, and the passphrase is typed in an extension window, never on the Gmail page.

Without a passphrase, anyone who can use your browser profile, or malware on your computer, can read the stored passwords, as with passwords saved by any mail app. Set a passphrase if others use your computer.

What the relay does with a message

Receives it over HTTPS from the extension, with the SMTP server name, port, username and password for that address.
Connects to your provider with encryption: TLS on port 465, or STARTTLS on 587/2525. If the server doesn't offer STARTTLS, it stops before sending your password. It never uses plaintext or port 25.
Signs in, hands over the message, disconnects.
If you chose "Save to Gmail Sent", connects to imap.gmail.com:993 and uploads the copy.
Returns the result to the extension and forgets the request.

Not stored: messages, passwords, addresses, IP addresses. The relay has no database, key-value store or queue. Cloudflare Worker logs are switched off ("observability": { "enabled": false } in the relay's configuration). If your provider refuses, the error sent back to the extension includes the server's reply, with the password lines replaced by ***.

Briefly held: to stop abuse, the hosted relay counts sends per SMTP account (server name + username) with Cloudflare's rate limiter: 20 per minute. The counter expires after the minute.

Who else is involved: Cloudflare runs the relay (Cloudflare's privacy policy) and processes the connection like any website host. Your email provider receives the message, as with any mail app.

What you have to trust

If you use the hosted relay, you trust that it runs the published code and that we don't change it to keep data. Cloudflare Workers can't prove to you which code is deployed. If that's not acceptable, deploy the relay yourself: it takes about ten minutes on a free Cloudflare account, and then the only parties involved are you, Cloudflare and your email provider.

Other safeguards

Only the extension can use the relay from a browser. The relay accepts browser requests only from extension pages (moz-extension:// and chrome-extension:// origins); websites get refused.
Self-hosted relays can require a token (RELAY_TOKEN), so nobody else can use yours.
Minimal permissions. The extension asks for storage and for mail.google.com, nothing else. It has no access to other websites.
No remote code, no analytics, no tracking. Everything the extension runs is in the package the store reviewed.
Only real clicks send. A web page can't trigger a send by faking a click; the extension acts only on events from your mouse or keyboard.
Refuses rather than guesses. If Gmail's layout changes, or an attachment or recipient can't be read, the extension refuses to send instead of sending something incomplete.
App passwords, not your main password. For Yahoo, AOL, iCloud, Fastmail and others, use an app password: it only allows mail access and you can revoke it in your provider's settings at any time.
Licence keys are checked offline with an Ed25519 signature. The extension doesn't phone home.

Reporting a problem

Found a security issue? Please write to adam.hale@atomicmail.ai before publishing it. The relay's source is published on GitHub at launch (link will appear here).