Privacy & security

Private by design. Locked down by default.

Everything KT8 Mail does to keep your address private, keep scams out of your inbox and make sure only the right people can sign in.

Privacy Boost

Your primary address stays private. Scams stay out. Only you get in.

Three essential layers of protection built into every KT8 Mail deployment at no extra cost: on-demand masked addresses, intelligent scam analysis, and passwordless authentication with Face ID, Touch ID, or Windows Hello.

Dedicated masked aliases New

Provide a unique, isolated address for every website, generated automatically as you register. When the first message arrives, choose to keep or block it—ensuring your real address is never exposed.

Automated expiry: Configure aliases to auto-deactivate on a specific date, after a set duration, or immediately after their first email.
Instant breach tracking: Spot data leaks instantly if a company shares, sells, or compromises your contact details.
Privacy-preserving replies: Respond directly from your masked alias so your primary email address remains strictly hidden.

Masked email in Settings: an address for each website, with On, Off and Ended labels, and a warning that mail to the Amazon address came from cheap-pills.biz

The first email to a new masked address, with Keep and Block buttons

Smart spam & phishing guard Upgraded

Incoming mail from unfamiliar senders is continuously analysed for common exploit patterns: spoofed display names (e.g. Royal Mail or PayPal), misleading links, lookalike domains, and brand-new web registrations.

Plain-English auditing: Every message filtered into Spam clearly explains the exact reason it was flagged.
Zero false positives for known contacts: Verified senders and people in your address book are never mistakenly intercepted.

A fake PayPal email in Spam, with the reasons it was moved there

Passkey & biometric sign-in New

Authenticate instantly using Face ID, Touch ID, Windows Hello, or your mobile security key. Eliminates one-time code delays and protects your account against phishing attacks.

Rapid setup: Register a new passkey in seconds under Settings › Account.
Flexible fallbacks: Email verification codes remain available as a secondary authentication method.

The KT8 Mail passkey sign-in page, with a Use my passkey button

Additional security included:

Tracker blocking: Neutralise hidden pixel trackers so senders cannot track when or where you open an email.
Session management: Securely end your session in one click when signing out from shared or public computers.

Privacy protection

Read your email without being watched.

Many newsletters hide tiny pictures that tell the sender when, where and on what device you opened their email. KT8 Mail blocks them before the email opens, and tells you who was trying.

Hidden trackers from Mailchimp, Google and others are blocked automatically
Large files go out as encrypted download links, with an optional password you can send by WhatsApp or text

Sign-in

Your inbox sits behind Cloudflare Access, Cloudflare's sign-in gate. Nobody reaches KT8 Mail until they've proved who they are.

Checked before the app opensEvery visit is checked against your Users list first. People who aren't on it never see the sign-in to your mail.
Passkeys or one-time codesSign in with Face ID, Touch ID or Windows Hello, or with a code sent to your email that expires after 10 minutes. There's no password to guess or leak.
Admin access is on the recordIf an admin opens someone else's mailbox, it's logged and shown to that person in Settings, under Account.
Sign out anywhereSign-ins last 30 days on your own devices. On a shared computer, sign out from Settings or the link at the bottom of the sidebar.
The API is off until you want itAPI keys only work on the mailboxes you choose, and can never delete email or change system settings.

Before mail reaches you

Three checks on every email.

1Cloudflare checks the senderEmail that fails sender checks (SPF and DKIM), breaks the sending domain's own DMARC rules or comes from a server on a known spam block list is turned away before it arrives.
2KT8 Mail checks for scamsMail from people you don't know is checked for misleading links, fake brand names, lookalike web addresses and brand-new domains. Your block list sends repeat offenders straight to Spam.
3Your rules sort the restInbox rules file, label or star what's left, and masked addresses tell you if a company passed your details on.

We believe everyone should own their own email.

Install KT8 Mail on your own Cloudflare account in about ten minutes. It's free.

Install now Back to the overview