How this site works
This is a separate, fully server-rendered client for neir.io. It exists so the service is usable with JavaScript completely disabled and without loading images, which matters a lot on Tor. Every page here is plain HTML and forms; nothing requires a script to run.
Account Key authentication
neir.io has no email/password login. An account is identified by a 16-character Account Key, generated randomly at signup, plus an optional 6-digit code from an authenticator app (2FA). A 12-word recovery phrase is shown once at signup as the only backup. There is no "forgot password" flow, and support cannot recover a lost key or phrase, because only one-way hashes of each are ever stored.
Encryption model, and how this site differs from the main client
Every account has an OpenPGP keypair. Message bodies are stored encrypted to that key. On the main JavaScript client, all key generation and all decryption happen inside your browser; the server never sees your private key or a decrypted message body.
That isn't possible without JavaScript running somewhere, and this site has none. So on this site specifically:
- At signup, if you choose to let this server generate your key pair, it is generated in this server's memory, used once to complete registration, and then discarded: never written to disk, never logged. You are asked to explicitly confirm this before it happens, and you can decline and use the main JavaScript site to sign up instead (your key never leaves your browser there), then come back here to use the rest of the site.
- When reading a message, decrypting it requires your private key, which requires your Account Key. This site asks for your Account Key once per session to unlock decryption, then, before decrypting anything, asks you to explicitly confirm that the server may transiently see your private key and that message's plaintext. If you decline, you can view the raw encrypted message instead (see below), or use IMAP with an app password and a real mail client that decrypts locally.
Nothing decrypted is ever written to disk, logged, or kept after your session ends or times out (20 minutes of inactivity). But this is a genuinely different trust model from the main client, where the server never has access to plaintext key material at all. If you want the strongest guarantee, use the main JavaScript site, or use IMAP/SMTP with an app password and a mail client that does PGP locally (Thunderbird with an OpenPGP plugin, or neir.io's own NeirMail desktop app).
Why this site uses an image CAPTCHA instead of the main site's proof-of-work
The main site's anti-abuse check for account creation runs a bounded cryptographic search and a memory-hard hash in your browser, with no CAPTCHA, no third-party vendor, no fingerprinting. That check requires JavaScript. Since this site has none, sign-up here instead uses a self-hosted, distorted-text image CAPTCHA (not a third-party service) to establish that a human is present, and this server computes the underlying proof-of-work on your behalf afterward, which is trivial computation for a server, but gated behind you having solved the CAPTCHA.
Data and retention
See the Privacy Policy for the full detail: message bodies are PGP ciphertext at rest, attachments are stored as plain files, Trash/Spam are emptied after 30 days, and account deletion is immediate and irreversible. This site does not change any of that; it is a different way to reach the same account and the same data.
Manual refresh only
There is no live update / auto-refresh on this site, since that requires either JavaScript or a persistent connection this simple server doesn't keep. Use your browser's reload, or the "Refresh" link on the inbox page, to check for new mail.