Your own webmail,
on your own hosting.

Before you start

• Hosting with PHP 8.1 or newer and MySQL 5.7+ or MariaDB 10.3+. The installer checks for the PHP extensions it needs (sodium, pdo_mysql, curl, mbstring, openssl). Most hosts have them all.
• An https:// address for the webmail, such as https://example.com/mail or https://mail.example.com. GhostParse only delivers to secure addresses, and passkeys and notifications need one. Most hosts include a free certificate.
• A GhostParse account with a verified domain and at least one email address on it. Create a free account.

1. Upload the files

1. Download the zip and unzip it. You get a folder called webmail.
2. Upload the folder to your hosting with your control panel's File Manager or FTP, for example into public_html. Rename it if you like: public_html/mail makes the webmail's address https://example.com/mail.

2. Create a database

In your hosting control panel (cPanel, Plesk, DirectAdmin and so on), open MySQL Databases. Create an empty database and a user, give the user all privileges on that database, and note the names and the password.

3. Get your GhostParse details

1. In the dashboard, open API keys and create a key with the send and domains permissions. Copy it: it's shown once.
2. Open Inbound webhook and copy the signing secret. It starts with whsec_.

4. Run the installer

Open your webmail's address in a browser. The installer starts by itself:

1. Check: it confirms your hosting has what's needed.
2. Database: enter the database name, user and password from step 2. The host is usually localhost.
3. GhostParse: paste the API key and signing secret from step 3.
4. Administrator: create your own sign-in, and choose the webmail's name.
5. Mailboxes: tick the addresses to use. Each one is switched on for sending and receiving, and its webhook is pointed at your webmail for you.

When it finishes, the installer locks itself and you can sign in. Back up config.php, in the webmail's folder, somewhere safe. It holds your encryption key, and without it your stored email can't be read.

5. On your phone and computer

• Install the app: on iPhone or iPad, open the webmail in Safari, tap Share, then Add to Home Screen. On Android, use Chrome's Add to Home screen. On a computer, choose Install in Chrome's or Edge's address bar.
• Passkeys: go to Settings → Sign-in & alerts → Add a passkey, then choose Use a passkey next time you sign in.
• Notifications: on each device, go to Settings → Sign-in & alerts → Turn on. On iPhone and iPad, do this in the Home Screen app (iOS 16.4 or newer).
• More people and mailboxes: under Settings → Users and Settings → Connect addresses.

Using nginx?

Apache and LiteSpeed hosts use the included .htaccess files. On nginx, add these rules, with /mail as your folder, so the app's private files can't be downloaded:

location ~ ^/mail/(app|storage|tests|vendor)/ { deny all; }
location ~ ^/mail/(config\.php|config\.php\.tmp|\.user\.ini|composer\.(json|lock)|phpunit\.xml|README\.md|build\.sh)$ { deny all; }
location = /mail/sw.js { add_header Cache-Control "no-cache"; }
client_max_body_size 48m;

Updating

Download the new version and upload its files over the old ones. Keep your config.php. Database changes are applied by themselves the next time the webmail is opened.

Check your download

The SHA-256 checksum of webmail-1.0.1.zip is:

f1b31ec434b4346ed45c2a67ba5f8e7ac4da84910dca6d66c8b1db6a24d6159b

To check it, run shasum -a 256 webmail-1.0.1.zip on a Mac or Linux, or certutil -hashfile webmail-1.0.1.zip SHA256 on Windows.