Webmail you actually own

Super-Duper
SquirrelMail

Classic webmail, rebuilt for today — a hardened fork with a modern inbox, strong sign-in, and a shield around every message.

See what’s inside Security posture
Super-Duper SquirrelMail crest — squirrel, shield, and locked mail

The story

SquirrelMail, super-duped

SquirrelMail taught a generation how webmail could feel light and fast. Super-Duper SquirrelMail keeps that spirit — and rebuilds the rest for PHP 8, modern browsers, and the threats of this decade.

Optional Enhanced Mode drops the old frameset for a frameless chrome with themes, phone layout, and a real HTML compose editor. Classic Mode stays available when you need it.

It is not a SaaS box in someone else’s cloud. It is software you host, theme, and lock down — for your customers, your staff, your mail.

2.0
Product line
PHP 8
Ready to run
Self-host
Your servers

Inside the product

Built for operators who care how mail feels

A single product surface: inbox, compose, security, and admin — without turning into another bloated dashboard.

  1. Enhanced Mode chrome

    Frameless UI with ThemesV2 palettes, Eyesaver type scale, and a phone-ready layout — while Classic Mode remains a first-class path.

  2. Sign-in that holds the line

    Passkeys and authenticator 2FA, salted login fields, abuse lockouts, and fail2ban-friendly logging — not yesterday’s open form.

  3. Compose that looks like mail

    Modern contentEditable HTML compose with inline images, without the abandoned editors that used to ship with the classics.

  4. Hardened message surface

    Sanitized HTML, CSP headers, CSRF tokens, and a long CVE list closed from the 1.4.22 era through current advisories.

  5. Operator tooling

    SM Admin, session activity, filters, message safety feeds, and the plugins you enable — your stack, your policy.

Super-Duper SquirrelMail security crest

Security

Shield first.
Mail second.

The crest is not decoration. The product assumes hostile input, stolen cookies, and curious bots — and is built accordingly.

  • No user enumeration on failed login — same message either way
  • Session regeneration after IMAP auth; passwords stay out of cookies
  • HttpOnly, SameSite, Secure cookies on HTTPS
  • CSP, nosniff, Referrer-Policy, Permissions-Policy
  • Captcha / reCAPTCHA paths when abuse thresholds trip

Get started

Ready for a webmail stack you control?

Super-Duper SquirrelMail is the product behind superdupersquirrelmail.org — self-hosted webmail with a modern face and a serious security spine.

Talk to us Back to the story