Protocol & Client Documentation
HumanMail User Guide
Everything you need to know about Proof-of-Personhood credentials, cryptographic inbox triage, privacy modes, and the Gmail extension.
Verify Your Human Identity (Persona KYC)
Before sending verified mail, a sender completes a one-time Proof-of-Personhood verification with an authorized KYC authority (like Persona).
3D facial scan or biometric passkey proving a live physical human is present.
Government passport NFC or ID binds certified legal name to sender email address.
Your client generates an Ed25519 keypair; private key stays encrypted on your device.
Choose Your Privacy Mode
HumanMail supports dual disclosure modes so that whistleblowers, journalists, and everyday senders are never forced to compromise their privacy.
Best for executives, sales, recruiters, and professional business mail. Recipients see your certified legal name (Mark Davis) and company domain.
Best for whistleblowers, activists, and privacy-conscious users. An identityCommitment hash proves humanhood while withholding your name. Recipients see ✓ Verified: Anonymous Human.
Cryptographic Signing & Anti-Sybil Daily Quota
When sending an email, your mail client canonicalizes message fields (From, To, Subject, Date, and SHA-256 body hash) and signs them with your Ed25519 private key.
Understanding Triage Categories & Badges
Receiving mail clients and gateways automatically triage incoming messages into clear security categories:
Valid Proof-of-Personhood credential. Senders are guaranteed to be real humans who own the address.
Legitimate system notifications, purchase receipts, GitHub alerts, and calendar invites.
No cryptographic proof provided. Flagged clearly so users exercise caution against AI scrapers and cold outreach.
Attacker claims to be an executive or colleague, but cryptographic credential belongs to a different entity.
Webmail Extension & Mail Transfer Agent (MTA)
HumanMail operates both on the desktop (via Chrome/Outlook extensions) and at enterprise boundaries (via Postfix/Sendmail Milters):
Chrome Extension
Injects verification pills directly into the Gmail and Outlook DOM, automatically routing unvalidated bot spam into a Quarantine folder.
Postfix / Sendmail Milter
Operates at Port 25, prepending RFC 8601 Authentication-Results: mx; humanmail=pass and streaming Prometheus metrics to enterprise SOCs.
Frequently Asked Questions
Will I stop receiving emails from people who haven't verified yet?
No. HumanMail is 100% backward compatible with legacy SMTP. Unvalidated emails are still delivered, but they are flagged clearly with ⚠️ UNVALIDATED SENDER and separated from verified human correspondence.
Can botnets register millions of fraudulent keys?
No. Each credential requires genuine biometric KYC or passport NFC proof from an authorized Attestation Authority. Registering 1,000,000 fake identities would require 1,000,000 valid government IDs and live faces, breaking botnet economics.
How fast is the verification process?
Verification takes approximately 0.2 milliseconds per email. Because the credential and signature are self-contained within the email headers, verification is completely local and stateless with zero database lookups.
Is my personal information stored on a public ledger?
No. HumanMail does not use a public blockchain. In Zero-Knowledge mode, only cryptographic nullifiers and commitments are signed, meaning no recipient ever sees your personal data.
Ready to Try HumanMail?
Test out the live interactive cockpit, mint your test credential, and experience email triage free of bot spam.
Launch Interactive Demo