Extend Bulwark,
your way.
Plugins and themes that snap into Bulwark Webmail. Free, open source, reviewed for every release — add new workflows, repaint the inbox, or build the extension you've been waiting for.
Featured this week.
Gravatar Avatars
by Linus Rath
Resolves Gravatar profile pictures for email contacts via the avatar transform hook
External Link Warning
by Linus Rath
Warns before opening external links to unknown domains. Admins can pre-populate a trusted domain list.
External Recipient Warning
by Linus Rath
Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.
Recently added.
PGP True End-to-End
by Paulhenry Saux
End-to-end OpenPGP for webmail: sign and encrypt outgoing messages, your drafts and their attachments. Automatically verify signatures and decrypt incoming PGP mail. Use local search index to get preview of emails and search your emails
OpenPGP
by samuelmiller36
End-to-end OpenPGP (GnuPG-compatible) for webmail: generate, import, export and manage public and private keys; encrypt, decrypt and sign messages; and automatically verify signatures and decrypt incoming PGP/MIME and inline-PGP mail. Private keys are stored encrypted at rest and unlocked into memory only for the current session, so secret material never leaves your browser. Runs in the privileged (same-origin) plugin tier with a bundled openpgp.js engine.
S/MIME
by Linus Rath
End-to-end S/MIME for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming CMS (PKCS#7) mail. Private keys are imported from a PKCS#12 (.p12/.pfx) file, encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally with bundled pkijs/asn1js.
Spam Score
by Linus Rath
Adds a Spam Analysis section to a message's "More details" panel. Reads the raw spam-filter headers (SpamAssassin / Rspamd score, threshold and level, plus any AI verdict) directly off the message and shows a colour-coded breakdown.
Libravatar Avatars
by Shuki Vaknin
Resolves Libravatar profile pictures for email contacts via the avatar transform hook. Libravatar is a federated, privacy-friendly Gravatar alternative.
Calendar Agenda
by Linus Rath
Shows an agenda of your upcoming calendar events in the sidebar.
External Mail Warning
by Linus Rath
Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.
Impersonation Notice
by Linus Rath
Shows a persistent top-of-app banner when the active session is a Stalwart master-user impersonation (username contains '%'), with a configurable 'Return to platform' button. Detection is automatic; admins configure the platform return URL and banner styling.
Jitsi Meet
by Linus Rath
Adds a 'Add Jitsi Meeting' button to calendar events. Meeting URLs are generated server-side via the /api/jitsi sidecar.
Gravatar Avatars
by Linus Rath
Resolves Gravatar profile pictures for email contacts via the avatar transform hook
External Link Warning
by Linus Rath
Warns before opening external links to unknown domains. Admins can pre-populate a trusted domain list.
External Recipient Warning
by Linus Rath
Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.
Most installed.
Impersonation Notice
by Linus Rath
Shows a persistent top-of-app banner when the active session is a Stalwart master-user impersonation (username contains '%'), with a configurable 'Return to platform' button. Detection is automatic; admins configure the platform return URL and banner styling.
Gravatar Avatars
by Linus Rath
Resolves Gravatar profile pictures for email contacts via the avatar transform hook
External Link Warning
by Linus Rath
Warns before opening external links to unknown domains. Admins can pre-populate a trusted domain list.
Subway Surfers
by Linus Rath
Writing emails is boring - it doesn't have to be. Adds a Subway Surfers sidebar to the New Message dialog, picking a random 6-minute jump-in point from a one-hour gameplay video.
Calendar Agenda
by Linus Rath
Shows an agenda of your upcoming calendar events in the sidebar.
Jitsi Meet
by Linus Rath
Adds a 'Add Jitsi Meeting' button to calendar events. Meeting URLs are generated server-side via the /api/jitsi sidecar.
Quick Notes
by Linus Rath
Per-email sticky notes in the sidebar — jot notes while reading emails
External Recipient Warning
by Linus Rath
Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.
Spam Score
by Linus Rath
Adds a Spam Analysis section to a message's "More details" panel. Reads the raw spam-filter headers (SpamAssassin / Rspamd score, threshold and level, plus any AI verdict) directly off the message and shows a colour-coded breakdown.
S/MIME
by Linus Rath
End-to-end S/MIME for webmail: sign and encrypt outgoing messages, and automatically verify signatures and decrypt incoming CMS (PKCS#7) mail. Private keys are imported from a PKCS#12 (.p12/.pfx) file, encrypted at rest with a passphrase, and unlocked into non-extractable WebCrypto keys that never leave your browser. Runs in the privileged (same-origin) plugin tier so all cryptography happens locally with bundled pkijs/asn1js.
External Mail Warning
by Linus Rath
Warns before sending email to recipients outside your safe-domain list, and flags incoming messages from external senders with a banner. Admins can pre-populate organisation-wide safe domains.
Libravatar Avatars
by Shuki Vaknin
Resolves Libravatar profile pictures for email contacts via the avatar transform hook. Libravatar is a federated, privacy-friendly Gravatar alternative.
Plugins and themes,
no lock-in.
Two kinds of extension, one directory. Every published extension is reviewed against the same set of rules and shipped from the same signed bundle endpoint.
Logic and UI you wire into the client
Drop new buttons, sidebars, and keyboard shortcuts into Bulwark Webmail — or hook the send / receive lifecycle to ship whole workflows.
- Toolbar, sidebar, and composer extensions
- Hooks for the send / receive lifecycle
- Calendar action integrations (Jitsi Meet, BBB, …)
- Typed JMAP client API, no raw HTTP
Pure-CSS skins for the whole inbox
Override Bulwark's design tokens to repaint fonts, colors, density, and accents. Zero JavaScript at runtime.
- CSS variables for the whole interface
- Light + dark variants in one bundle
- Auto-switches with the system theme
- Tiny payload — usually under 5 KB
Build something worth installing.
Read the
developer docs.
API reference · manifest schema hook lifecycle · examples
The extension API surface is small — a typed JMAP client, a handful of UI slots, and a manifest. Read it cover-to-cover in an afternoon.
Know the
review rules.
OSI license required no minification · no telemetry
Every submission goes through an automated code scan and a human reviewer. The rules are short and public — read them before you submit so the review is a formality.
Submit your
extension.
Sign in with GitHub repo + tag + manifest.json
Sign in with GitHub, point us at a public repo, pick a tag. We fetch the bundle, run the scan, queue it for review. You get notified on the same GitHub account.