Roundcube review: webmail with a choice of host

Roundcube is a free open-source webmail client for reading and sending email through a browser.² It suits people whose hosting company provides it, or households and organisations with someone to manage a server. Its privacy appeal is the choice of who runs that interface, alongside practical controls over what messages load.

Last checked October 28, 2026.

At a glance

• What it is: A browser interface for an existing IMAP mailbox.²
• Works on: Web browsers, with a responsive interface for different devices.¹
• Price: Free software; arrange email hosting separately.⁴
• Licence: GPL-3.0-or-later, with exceptions for skins and plugins.²
• Best for: People who want webmail with a choice of operator.
• Official site: roundcube.net

What Roundcube does and how it protects your privacy

Roundcube connects to an IMAP server to work with your mailbox.² IMAP is the standard way an email client accesses mail held on a server. Think of Roundcube as the window onto your inbox: choosing a different window does not, by itself, change who holds the mail.

Running it requires a web server, PHP, a database, and IMAP and SMTP mail servers.¹ SMTP is the system used to send email. For most readers, the practical route is to ask an existing mail provider whether Roundcube is available, rather than take on server administration.

Roundcube’s preferences include controls for remote images and read receipts.⁵ Start with those settings, then ask the host about its privacy policy. Decide who you trust to operate both the mailbox and webmail before moving sensitive correspondence.

Roundcube key features

• Folders: Organise messages into IMAP folders instead of leaving everything in the inbox.¹
• Conversation view: Group related messages into threads for easier reading.¹
• Address book: Keep contacts together, including groups for regular correspondents.¹
• Search: Look for messages and contacts when you need an older conversation.¹
• Sender identities: Use multiple sender identities for different correspondence.¹
• Remote-image controls: Decide whether messages can load images from other servers.⁵
• Extensions: Plugins let administrators add capabilities to the installation.²

Roundcube pros and cons

Pros

• Open-source licensing allows redistribution and modification.²
• Browser support covers the major desktop browser families.²
• Plain-text display is available for formatted messages.⁵
• Administrators can extend and customise the interface.²

Cons

• It needs an existing mail service; installing Roundcube does not supply one.⁴
• Self-hosting involves configuring a database and maintaining a web server.⁷
• There is no affiliated native mobile app.⁴
• Enigma encryption still requires trust in the server.⁶

Is Roundcube safe and private?

Nextcloud GmbH is the project’s steward.⁴ The current stable release is 1.7.5, published on October 19, 2026, alongside the 1.6.20 security update.³ That release includes fixes for bypasses of remote-content blocking.³ Ask your host who installs security updates and how quickly.

The installation guide documents temporary files and logs on the webmail server.⁷ Treat the webmail operator as part of your privacy decision. Ask where mail, backups and webmail data are kept, how long logs remain, and whether the host adds analytics or other telemetry. Do not assume an open-source label answers those questions for a particular service.

Roundcube’s Enigma plugin supports signed and encrypted PGP messages, but stores users’ private keys on the server and performs encryption and decryption there.⁶ A private key is the secret needed to unlock encrypted messages. Choose this arrangement only if trusting the server fits your needs; a PGP option alone is not a promise that the operator cannot access message contents.

The user guide explains that remote images can reveal to a sender that a message was opened.⁵ Keep them blocked unless you deliberately need them. Ask the administrator to require HTTPS for browser access and encrypted connections to the mail servers, too.

How to get started with Roundcube

1. Choose the right route. Ask your existing provider for its official webmail address. For a new server installation, start at the official download page and follow the installation guide.⁷ Do not enter your mailbox password into an unfamiliar login page.
2. Leave server setup to the responsible administrator. Roundcube’s guide covers the database, mail settings and installation checks.⁷ If those tasks are unfamiliar, choose a provider that handles them.
3. Sign in through your provider’s address. Bookmark it once confirmed. Use a unique password; the KeePassDX guide is a useful starting point when choosing how to manage passwords.
4. Set privacy preferences. Under Preferences, review Displaying Messages and the remote-image option, then save changes.⁵ Review read receipts as well.
5. Try a small first task. Send yourself a short message, reply, search for it, and move it into a folder. Check that the workflow feels comfortable before relying on it daily.

Who should use Roundcube and who might prefer something else?

Roundcube is a good choice when your provider maintains it and you want straightforward browser access. It also suits a small organisation with a capable administrator who wants control over its webmail setup. Before choosing, ask about update responsibility, support and the total hosting bill.

For a phone-first alternative, consider FairEmail: it is an Android email app with offline storage and operations.⁸ If you want someone else to manage the whole email service, compare hosted providers instead of treating a webmail interface as the entire purchase.

Frequently asked questions

Is Roundcube free?

Yes, Roundcube is free software rather than a hosted email service.⁴ Budget separately for any mailbox, server and administration you need. Ask your provider what its quoted price includes.

Does Roundcube work on iPhone and Android?

Its responsive interface supports different devices, so browser access is the intended route.¹ The project says it is not affiliated with native mobile apps.⁴ Use your provider’s confirmed webmail link on a phone.

Does Roundcube encrypt all email automatically?

PGP message encryption is available through Enigma, whose encryption and decryption take place on the server.⁶ Do not assume that ordinary messages become private from your host simply because you read them through Roundcube.

Where do I log in to Roundcube?

Ask your hosting provider or IT administrator; the Roundcube project directs account questions to them.⁴ Use the address they confirm rather than a login page found through a search advertisement.

Sources

1. Roundcube: About the Roundcube webmail project
2. GitHub: Roundcube Webmail repository and README
3. Roundcube: Security updates 1.6.20 and 1.7.5 released
4. Roundcube: Webmail support
5. Roundcube documentation: Preferences
6. GitHub: Roundcube Enigma plugin README
7. GitHub: Roundcube installation guide
8. FairCode: FairEmail