What really happens to your credentials
You give MailTransfer temporary access to two mailboxes. This page describes exactly what happens technically — without marketing phrases, so you can judge for yourself whether to trust us.
What happens to my password?
From the moment you type it in to its final deletion, your password goes through seven clearly defined steps.
One-time entry
You enter the password once in the form. The transfer to our server runs exclusively over HTTPS.
Immediate encryption
Before it is even stored, we encrypt it with libsodium (secretbox, XSalsa20-Poly1305) — it never touches the disk in plain text.
Key stored separately
The key for this is kept in its own file outside the database with file permissions 0600. A database copy alone does not make the passwords readable.
Decrypted only within the process
Decryption happens exclusively within the running transfer process — nowhere else, not even in our own admin interface.
Pass file instead of command line
For the actual transfer, the password goes into a file with 0600 permissions, never as a command-line argument — otherwise it would be readable in the server’s process list.
Shredded immediately
After each transfer run, this pass file is overwritten and deleted, not just removed.
Automatic deletion
Credentials and logs are permanently deleted at the latest 72 hours after completion — or immediately if you trigger it on the status page.
What we do not store
MailTransfer reads e-mails in order to copy them — not to analyse them.
- E-mail content
- Subject lines
- Attachments
- Address books and contacts
Only figures and folder names for the completion report end up in the database — for example “INBOX/Invoices: 214 messages”, never their content.
Protection against abuse
These limits do not only protect your data — they also stop MailTransfer being used as a tool for port scans against other people’s servers.
Public addresses only
Connections to internal, private or local IP ranges are blocked — a target server must be reachable from the public internet.
IMAP ports only
Only ports 993 (SSL) and 143 (STARTTLS) are allowed. Any other port is rejected before a connection is even attempted.
DNS answers pinned
The resolved IP address is fixed for the entire connection (DNS pinning); a DNS entry changed afterwards can no longer redirect the connection to a different target (DNS rebinding).
Rate limiting
Connection tests and new transfers are limited per visitor and time window, so no single account can misuse the system as a scanner.
Honeypot
A form field invisible to humans exposes automated bots before a connection is even made.
Copying, not moving
MailTransfer reads your old mailbox and writes a copy to the new one. This is not a marketing claim — it is how the software is built.
The source stays untouched
Messages are only ever read on the source server. Nothing is deleted, moved or marked as read.
Delete commands are excluded
The command generator for the transfer has no --delete parameter — it cannot technically be assembled from the available building blocks.
Where this runs
MailTransfer runs on our own servers in Germany and is operated by PixAgentur in Kiel.
Germany IONOS Plesk PixAgentur Kiel
Trust us with your credentials and get started
The connection test is free and non-binding — you will see immediately whether both servers are reachable.