Foundry376/Mailspring · error

Mailspring could not store your password securely because…

Error message

Mailspring could not store your password securely because encryption is not available on this system.

What it means

KeyManager._writeKeyHash guard: secureStorage.isAvailable() is false, so there is no OS keychain/secret service to store the encrypted password keyset — on Linux this means no org.freedesktop.Secret.Service or xdg-portal Secret provider is running. The error halts storing any secrets rather than writing them unencrypted.

Solutions

1. On Linux, install and start a secret service provider (gnome-keyring, KWallet, keepassxc with the freedesktop Secret Service) and restart Mailspring
2. On macOS/Windows, ensure the OS keychain is accessible and not locked by policy

When it happens

Trigger: Thrown at app/src/key-manager.ts:162 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Foundry376/Mailspring@648c685d60 (2026-09-03). Data as JSON: /api/errors/0711d6ed16422745. Report an issue: GitHub.

Appendix: source

Thrown at app/src/key-manager.ts:162

      } catch (err) {
        console.warn('Mailspring could not re-encrypt your saved passwords with the new key.', err);
      }
    }

    return keys;
  }

  _encryptionUnavailableHint() {
    return process.platform === 'linux'
      ? localized(
          ' On Linux, Mailspring requires a secret service such as org.freedesktop.portal.Secret or org.freedesktop.Secret.Service. Please ensure a provider is installed and running, then restart Mailspring.'
        )
      : '';
  }

  async _writeKeyHash(keys: KeySet) {
    if (!(await secureStorage.isAvailable())) {
      throw new Error(
        localized(
          `Mailspring could not store your password securely because encryption is not available on this system.`
        ) + this._encryptionUnavailableHint()
      );
    }
    const enrcyptedCredentials = await secureStorage.encrypt(JSON.stringify(keys));
    AppEnv.config.set(configCredentialsKey, enrcyptedCredentials);
  }

  _reportFatalError(err: Error): never {
    // ensureClients is throttled rather than serialized, and _getKeyHash's callers report its
    // throw a second time, so only the first failure gets a dialog. The rest still propagate.
    if (this._fatalErrorReported) {
      (err as any).noSentry = true;
      throw err;
    }
    this._fatalErrorReported = true;

View on GitHub (pinned to 648c685d60)