Scales natively.Secure at the core.
FOLD is a native email client for people who take their inbox seriously: engineers, researchers, journalists, sysadmins. Its own IMAP engine, S/MIME and OpenPGP built in, no telemetry. Security is a design constraint, not a finishing touch.
- Dependencies
- 0
- third-party packages in engine and interface, 103,000 lines of Swift
Folded corner: the claim carries a source, printed at the foot of the cell. All sources
What works today
TestFlight · macOS and iOS · as of 2026-09- One inbox across all accountsunified inbox
- Delta sync and pushCONDSTORE QRESYNC IDLE
- Send with undo0 to 30 s outbox
- Encrypted mailS/MIME OpenPGP
- Sender checks on deviceDKIM DMARC BIMI
- Fortress Modeper account Argon2id
- Four interface languagesEnglish German Japanese Arabic
- Rules on every new messagefilters in the search grammar
500,000 messages. Timed.
The storage engine, benchmarked against a synthetic mailbox of half a million messages.
- 58 ms
- full-text search across 500,000 messages
- 0.7 ms
- 50 message headers read from SQLite
- 9 ms
- open the store, first index snapshot
- 67 s
- to ingest 500,000 messages
FoldBench, release build, Apple M1 Ultra, macOS 27, median of five runs. These are storage-engine timings. App cold start, frame time and memory are budgeted below and not yet instrumented.
Email is a tool, not an ad channel.
Many mail clients route your mail through a vendor cloud, pull in half the web as dependencies and call the banners productivity. FOLD goes the other way: less code, less surface, fewer assumptions.
Progressive disclosure
A reply opens with the To field. Cc and Bcc appear when you ask for them. What is on screen has to earn its place.
Keyboard first
On the Mac, ⌘K reaches compose, reply, move, every folder and every account. Search takes operators like from:, is:unread, before:6m and /regex/.
Provenance you can check
FOLD verifies DKIM signatures on your machine and aligns them with DMARC. You see whether a message comes from the domain it names, not what a server says about it.
RFC 6376 8463 7489
An archive that stays searchable
Search across all accounts, offline, by subject, sender and recipient. Conversations are threaded by Message-ID and References, so they hold across accounts and years.
JWZ threading SQLite FTS5
How FOLD is laid out.
Four stylised views, drawn from the running build. Real screenshots follow with the release.
Three columns
Mailbox, message list, message detail. On the Mac built for keyboard and trackpad, on iPad the same three columns through the system split view.
Command palette
Compose, reply, move, switch accounts and jump to any folder with ⌘K. Search operators such as from:, is:unread and /regex/ right in the field.
Header and security inspector
Raw headers, and for every DKIM signature its domain, selector and algorithm. On the Mac an activity window shows sync steps and the SMTP transcript, kept in memory only.
Conversation view
Threads built with the JWZ algorithm from References and In-Reply-To, deduplicated by Message-ID across accounts, read as a stacked history. One switch in settings.
One grammar, everywhere.
The search field, the command palette, filter rules and the command line share one parser. A rule is a saved search plus an action.
from:ci@acme.dev is:unread after:2026-01-01 -is:flagged
subject:"deploy failed" /timeout|5\d\d/
size:>10M before:6m is:unread$ foldmail search 'from:alerts@acme.dev is:unread' --quiet \
| xargs foldmail flag --add '\Seen'
$ echo $?
0Say what you mean
from:, to:, cc:, subject:, is:unread, is:flagged, label:, size:>10M, before: and after: with dates or 30d, 6m, 1y. AND, OR, parentheses, phrases in quotes, and a minus to leave out a status such as -is:read. In German too: von:, betreff:, ist:ungelesen.
Across every account
SQLite FTS5 over subjects, senders and recipients, across all accounts at once and offline. /regex/ narrows the hits by subject and sender. Message bodies are not in the local index yet; on iPhone and iPad FOLD can also ask the server.
Filters in the same grammar
Mark read or unread, flag, move to a folder. Rules run on every new message on Mac and iPhone, and a preview shows what a rule set would touch before you apply it. Forwarding and auto-replies are not enabled yet.
foldmail
Git-style subcommands: search, read, flag, delete, compose, outbox, filter. --json for machines, --quiet for IDs, exit codes 0 to 4. Runs in internal builds today, not yet bundled with the app.
Shortcuts, Siri and Spotlight through App Intents, and interactive widgets. The shared action layer they build on is in place.
Our own engine, in Swift.
IMAP and SMTP written in Swift on Apple's Foundation streams. No C mail library, no bridge, no SDK in between.
Type your address
FOLD finds servers through built-in provider profiles, DNS and your domain's own autoconfig file. A signed provider bundle can update the profiles without sending your mail domain. Mozilla's central database is not queried by default.
OAuth where it counts
Google OAuth uses PKCE in the system browser, without a client secret in the app. Microsoft sign-in is implemented but not available yet: client registration and live acceptance are still pending. Provider approval is a separate requirement.
Aliases, answered right
Several accounts, several aliases each, every one with its own name and signature. A reply goes out from the address the message was sent to.
Only the delta
After the first pass FOLD keeps the server's HIGHESTMODSEQ and fetches only new mail, changed flags and deletions. Servers without the extension get a clean full sync.
RFC 7162 CONDSTORE QRESYNC
Live over IDLE
The server announces new mail itself; FOLD renews the session every 25 minutes. Servers without IDLE are polled.
RFC 2177
Built for size
Every connection and storage tier is its own Swift actor. One sync engine serves all accounts with four connections each, one of them always kept free for what you are doing.
Running in TestFlight today.
Public App Store versions for Mac, iPhone and iPad are in review. Until release, FOLD is available to invited TestFlight testers.
Five layers. None of them stands alone.
Each layer has its own job and its own tests. If one gives way, the next one holds.
- Security first, not last.
- Auditability beats convenience.
- Defense in depth.
- Minimal attack surface.
- L1
TLS
Strict certificate and hostname checks with no override. STARTTLS is enforced: if the upgrade fails, or bytes arrive before it, the connection is dropped. Unencrypted IMAP and SMTP are refused.
- L2
Auth
OAuth 2 with PKCE where the provider supports it. On SMTP, SCRAM-SHA-256 comes before CRAM-MD5 and PLAIN, and PLAIN never leaves TLS.
- L3
Sandbox
App Sandbox and Hardened Runtime. Entitlements: outgoing network, files you pick, one keychain group, the iCloud container for optional sync. No library-validation bypass.
- L4
Keychain
Passwords and tokens stay in the Keychain, bound to this unlocked device. Nothing syncs by default; password sync through iCloud Keychain is a separate opt-in.
- L5
Render
JavaScript in HTML mail is off. Remote content waits for your approval, a click on a link shows its real target first, saved attachments carry the quarantine flag. The MIME parser has hard limits on depth, parts and header size.
Fortress Mode
Encryption on top of FileVault. Argon2id (64 MiB, 3 passes) turns your passphrase into a 256-bit key that lives in memory only. Each account gets its own HKDF subkey, and AES-256-GCM seals the header database and the message cache. After inactivity the vault locks and the key is wiped.
Checked, not claimed: S/MIME and OpenPGP interoperate with real GnuPG and OpenSSL, DKIM verifies byte for byte against the RFC 8463 vector, a regression suite replays historic mail-client CVEs, and five fuzz targets harden the parsers.
S/MIME and OpenPGP. Both built in.
Sign, encrypt and decrypt on the Mac and on iPhone, checked against real GnuPG and OpenSSL.
Certificates, collected and checked
Import your .p12 identity and recipient certificates, or let FOLD collect them from signed mail. A valid signature whose certificate does not match the sender is marked untrusted. On iPhone all of this works too; there, recipient certificates come from signed mail, manual import follows.
Modern core, legacy contained
Ed25519 signatures, Curve25519 encryption keys and AES-256, always with an integrity check against EFAIL. Your correspondents' RSA keys keep working. CAST5, IDEA, Blowfish, 3DES, MD5 and SHA-1 signatures are refused.
Generate or import
Create Ed25519 and Curve25519 keys in FOLD or import your GnuPG keyring. Private keys rest passphrase-protected in a keychain vault bound to this device.
Visible as you type
Recipient chips show who can receive encrypted mail while you type. Signing and encryption are two switches, nothing more.
Checked on your device.
FOLD recomputes DKIM itself: body hash, DNS key, canonicalisation, signature. A server's Authentication-Results header is not taken on trust.
Computed on your machine
Ed25519 byte for byte against the RFC 8463 reference vector, RSA against an openssl-signed test message. Keys shorter than 1024 bits are rejected. The DNS lookup happens when the message body loads.
Aligned with the sender
FOLD aligns its own DKIM result and the SPF result from the server header with the visible From address. Only that alignment turns a signature into proof.
RFC 7489
Results at a glance
Compact SPF, DKIM and DMARC badges show available authentication results in the reader. Select a badge to see its status, check source and details. Results reported by the receiving mail server remain distinct from FOLD's own DKIM verification.
Brand logos, verified
A sender's logo appears only when DMARC passes with an enforcing policy and the mark certificate chains to one of the bundled BIMI roots. The logo comes from the certificate itself and is sanitised before it is drawn.
BIMI VMC bundled roots
Apple frameworks. Swift 6. Our own engine.
A native app on what the operating system already ships. No cross-platform layer, no web view dressed up as an app.
Stack
- Language
- Swift 6 language mode, strict concurrency, ExistentialAny.
- Interface
- SwiftUI first. AppKit and UIKit only where SwiftUI falls short.
- Networking
- Own IMAP and SMTP engine on Foundation streams, STARTTLS on the live connection. No C library.
- Storage
- SQLite without an ORM: header store (WAL), content-addressed message cache, full-text index (FTS5).
- Crypto
- CryptoKit, Security and CommonCrypto. Where Apple has no primitive, FOLD implements it and checks it against reference vectors: Argon2id, BLAKE2b, AES-OCB.
- Concurrency
- 55 Swift actors. Every connection and storage tier is isolated.
- Dependencies
- Engine and interface: Apple system frameworks only. The updater of the direct download (Sparkle) lives in the app shell alone.
Budget
Design targets- Cold start
- ≤ 300 ms
- Tap to first visible list row
- Scroll frame
- ≤ 8 ms
- Hard limit 16 ms, also at 500,000 messages
- Search
- ≤ 50 / 200 ms
- Headers / full text
- Memory
- 80 / 150 / 250 MB
- iPhone / iPad / Mac working set
Design targets from the performance specification. What is measured today is shown above.
Every message body is addressed by its hash
The message cache stores each body under its SHA-256. Identical content lands on disk once, and a body altered afterwards fails its check the moment it loads. On top, FOLD checks every fetched message for size and MIME completeness and offers to reload an incomplete one instead of passing it off as whole.
SHA-256 checked on every load
Which RFCs FOLD implements, and which not yet
Every standard a mail client is measured by, with its status in the code and the reason for every gap.
All standards- Implemented
- 58
- Partial
- 8
- Open
- 10
- Deliberately not
- 6
Short questions, short answers.
Can I try FOLD?
FOLD runs in internal TestFlight testing. Public App Store versions for Mac, iPhone and iPad are in review. You can leave your address on the download page for a one-time release notification. A direct Mac download is planned separately.
Which platforms are supported?
macOS 14 Sonoma and later, iOS and iPadOS 18 and later. Both apps share the same engine and run in TestFlight today. The Mac is ahead on a few features: drag and drop, the smart-folder editor, VIP senders and the quota display.
Which languages does FOLD speak?
The interface is available in English, German, Japanese and Arabic, on the Mac, iPhone and iPad. On iPhone and iPad you can pick the language inside the app, independently of the system language.
Why no third-party libraries?
Because every dependency is attack surface. CryptoKit, Security, SQLite and Foundation cover what the engine needs. Anyone who reads Swift can read all of it, and nobody has to trust someone else's build output. The one exception is the updater of the direct download.
What about OpenPGP and S/MIME?
S/MIME with .p12 identities and recipient certificates, RSA and AES; AES-GCM, which S/MIME 4.0 asks for, is not supported yet. OpenPGP with Ed25519 signatures, Curve25519 encryption and AES-256 with an integrity check, plus RSA for existing keys, checked against real gpg; version 6 keys are not supported yet. The broken paths stay out by design: MD5, SHA-1 signatures, CAST5, IDEA, 3DES, and anything without an integrity check.
Is FOLD open source?
No, the code is proprietary and published by Datargo GmbH. It is tested rather than trusted: more than 3,000 automated tests, interoperability checks against Dovecot, gpg and openssl, and an internal adversarial audit in June 2026 (65 findings, none critical, all tracked). An external penetration test is planned; no completed external assessment is documented yet.
What will FOLD cost?
Pricing is not final. Two things are: security features will never be a paid extra, and there will be no advertising model.
What happens to my data?
It stays on your device. FOLD talks to your mail servers, to DNS, to your domain's autoconfig file during setup, to Google for OAuth sign-in, and for BIMI logos to the sender's certificate host once DMARC has passed. iCloud sync is opt-in. No telemetry, no crash reporter.
Mail, taken seriously.
On the Mac, iPhone and iPad.
FOLD for Mac, iPhone and iPad runs in internal TestFlight testing. Public versions are being prepared for the App Store; the direct Mac download is planned separately.
To the download