Monthly Updates Report for my website

Shutbox — Tue, 01 Sep 2026 19:05:08 +0000

A few weeks ago, I created a post that offered a glimpse of my personal privacy-first email platform.

Since then, I have actively worked on a few things over the past 2 weeks.

1. UI Overhaul

The primary goal is to have a minimal and clean UI for emails, which made me reconsider my current design, as it looked like something from 2010.

I thought about it for a while, and then it clicked for me. Skiff Mail is my inspiration for the project, so I created the UI in a twisted Skiff style.

Old UI:

New UI:

Super satisfied, and it took a while for me to come up with this!

2. DMARC & DKIM Verification

Initially, inbound emails were not being verified for legitimacy, and I wanted to implement BIMI SVGs for official accounts to display their profile picture. But it looked off-putting in the actual UI, so I removed it. But now DMARC and DKIM verification for inbound emails works; it adds a few more seconds before the email appears in the inbox, though.

3. Passkey and 2FA implementation

These features are super important for security, so I have added these too. Passkey implementation is currently wonky, not that it does not work. It authenticates you to the session, but it cannot be used to decrypt your mail; it needs a password. This is by design, due to how OPAQUE works.

4. Avatar Generation

In my old UI, avatars were simply the first two letters of the email/name supplied. However, in the new UI, I have implemented Pixel Art from DiceBear, which has reportedly 1.13 × 10¹⁶ unique combinations- quadrillions in combination- which makes the email appear more lively.

5. On-device mail indexing

Previously, this was not implemented properly, resulting in broken client-side searching. Shutbox never sees your email and therefore cannot do server-side searching. For this reason, a summary is constructed every time you log in and stored in an encrypted format in the browser's IndexedDB. Whenever an email is opened, further hydration is provided to this encrypted storage (emails don't load until you actually open them; opening decrypts the email in the client). This also helped in adding simple filters such as from, to, is: starred/unread, etc.

These are all the changes I have implemented so far. Is there something else that the email needs? Would love to know your opinions!

Website: https://shutbox.im

A Minimalist Privacy-Email Service Website

Shutbox — Wed, 19 Aug 2026 14:31:54 +0000

Introduction

I used to be a paying customer of Skiff Mail, and part of what made me use it was not only that it was a privacy-focused email service, but also its beautiful UI.

However, on February 9, 2024, Notion acquired it, and the company pulled the plug on the Skiff projects entirely. A few years passed, and I had yet to find a service that offered the same balance between privacy and Aesthetic UI/UX.

That is not to say that privacy-focused email services themself weren't available; but that the UI of existing services was not to my taste.

Some examples of such services are:

Proton Mail: The most famous privacy-first email service provider. The UI itself is simple but is not to my taste.
Tuta Mail: The UI feels clunky for me personally

Not to say that these services have bad UI; it's just that my comparison standard for them is Skiff.

During 2024, I was still in my 2nd year of college. Ever since Skiff pulled its plug, I really wanted to create my own privacy-first email service. Now, I am a graduate with a job, which gives me money to work with. So, I finally decided to create my service.

https://shutbox.im

Now, I know it's not the greatest UI out there, and it could feel worse than Proton Mail or Tuta Mail in terms of appearance, but this is just my base UI as I try to perfect it more and more until I reach a desirable UI that truly makes me feel the same way that Skiff's UI made me feel.

Internals

For my architecture, I chose the following:

SMTP Backend: Elixir (gen_smtp and Phoenix)
Website Backend: Golang
Website Frontend: Next.js (SEO Friendly)
Job Queuing: OBan
Database: PostgreSQL

I chose Elixir due to my limitation with my server's memory limitations and how efficient the BEAM VM is when it comes to multiple processes.

For password authentication, I chose to use OPAQUE (Strong Asymmetric/Augmented PAKE). It's a bit difficult to explain, but if you are curious, you can read more about it here. Basically, it allows a client and server to authenticate a password without ever exchanging the password (in either Cleartext or Encrypted) directly.

This service was not designed for regular email use, but for a permanent throwaway account of sorts. Where you can just use the email when you don't want to use your real email, but also keep the throwaway email just in case you ever need something from those signed-up accounts in the future.

By default, I provide 5GB of storage; however, for normal use, you will never find yourself using that much amount of storage.

While the website features a "Payments" page to upgrade plans, it's non-functional. Crypto payments are set up but largely untested.

Issues

It goes without saying that if a service can be abused, then it will be. Not scanning anything also creates issues. It makes it harder to segregate bad actors from regular users. Yes, behavioral anomalies can be looked out for, but it is not a sure-fire method of dealing with bad actors.

Emails depend on two things:

IP Reputation
Domain Reputation

Each time a bad actor sends an email that someone else flags as spam, a scoring system slowly determines a Domain/IP to be spam, effectively causing emails to land in Trash instead of Inboxes.

Currently, my approach is to moderate manually. I have around 13 legitimate users who are using the service, with a total of 40 accounts registered (4 are mine), without ever advertising.

In the past few days, I suspended 6 accounts manually due to their names imitating famous brands.

Closing words

All in all, I had a lot of fun working on this project. I will continue making progress on the website. Until then, you are free to try out the website!

DEV Community: Shutbox