Encrypted credentials
SMTP passwords and API keys are encrypted at rest with AES-256-GCM. They are decrypted only in memory to send your email and are never shown back in the dashboard. API keys are looked up by SHA-256 hash.
Security
Your SMTP login is the keys to your inbox. We treat it that way.
How FormSMTP protects your credentials, your contacts and the people who email you.
Passwords & sessions
Account passwords are hashed with scrypt and a per-password salt. Sessions are random tokens stored hashed on the server, in HttpOnly, Secure, SameSite cookies, and you can end them all from your account.
Safe public keys
Form submissions always go to the project owner, never to an address a visitor picks. Allowed websites, allowed recipients, hourly limits and a honeypot keep a key in public HTML from becoming a spam tool.
Isolation between accounts
Every project belongs to one account, and every request is checked against it. One account can never read another’s projects, keys, contacts or logs.
Infrastructure
All traffic uses HTTPS with automatically renewed certificates. The app runs as an unprivileged service with a hardened systemd sandbox and is not reachable from the internet except through the web server.
Data minimisation
We keep send logs (recipients, subject, status, errors) for a limited time and do not store message bodies sent through the API or forms after handing them to your SMTP server. See the privacy policy.
Sign-in protection
Rate limits on sign-in, sign-up and password reset; OAuth accounts link automatically only when both sides have proven the same email; cross-site writes are blocked.
Report a vulnerability
Found something? Email hello@formsmtp.com with “Security” in the subject. We respond quickly and credit researchers who report responsibly.
Limited-time offer
Secure by default. Free to start.
The first 2,000 users get 10,000 emails a month, free forever.