Most desktop email clients store passwords in plaintext config files or SQLite databases readable by any process on the system. cji.email takes a different approach: every credential — IMAP password, SMTP password, OAuth access token, and refresh token — is stored in your operating system’s native secure credential store.
Native OS Keychain, Not Files
| Platform | Credential Store Used |
|---|---|
| macOS | Apple Keychain Services |
| Windows | Windows Credential Manager |
| Linux | Secret Service API (libsecret / GNOME Keyring) |
The Rust backend uses the keyring crate to interface with each platform’s native API. No passwords are written to disk in any readable form by the application.
The Consolidated Master Blob
Accessing the system keychain for every sync cycle would be slow and could trigger repeated OS-level authorization prompts. To avoid this, cji.email uses a consolidated credentials architecture:
- Single keychain entry — All credentials are bundled into one encrypted master blob stored under the service identifier
cji-email-service. - In-memory cache — On startup, the master blob is loaded into a Rust
Mutex-protected in-memory cache. - Unified write — When credentials are added or updated, the memory cache is updated and the entire blob is written back to the OS Keychain in a single atomic operation.
This eliminates per-operation keychain round-trips while keeping all credentials under OS-level protection.
Automatic Legacy Migration
Older versions of the app stored credentials as individual keychain entries. On startup, if legacy entries are detected:
- The legacy credential is read from the old keychain entry.
- It’s inserted into the new consolidated master blob.
- The master blob is saved back to the OS Keychain.
- The legacy individual entry is deleted.
Migration is silent and automatic. No user action is required.
What’s Stored vs. What’s Not
| Data | Storage Location |
|---|---|
| Email address, IMAP host/port | Local SQLite / config file |
| IMAP password | OS Keychain (master blob) |
| SMTP password | OS Keychain (master blob) |
| OAuth access token | OS Keychain (master blob) |
| OAuth refresh token | OS Keychain (master blob) |
Credential-Free Account Export
When you export your account profiles for migration to a new machine, the backup JSON is automatically scrubbed:
imap_config.password→ removedsmtp_config.password→ removed- OAuth tokens → never included
Even if the exported file is intercepted, it contains zero usable credentials. The server configurations (host, port, username, folder mappings) import cleanly on the new machine, and the user authenticates fresh to populate the new device’s keychain.