Forwarding address or IMAP plugin: which is safer for your Obsidian vault?

The short answer

Think about blast radius. If something goes wrong with an IMAP plugin, the exposure is your whole mailbox. If something goes wrong with a forwarding service, the exposure is the emails you sent it, for as long as it keeps them.

So: if you'd never hand a tool your mailbox login, forward. If you'd never let a third party touch your mail, use IMAP and look after the password carefully.

How IMAP plugins work

You give the plugin your mail server, username and password (ideally an app-specific password). It logs in, reads unread mail or a folder you choose, and converts the messages into Markdown notes. There's no middleman: the mail comes straight from your provider to your vault.

Where each plugin keeps that password varies a lot. At the time of writing (November 2026):

• Email Importer (IMAP) stores the password in plaintext in the plugin's data.json file, runs on desktop only, and its listing recommends an app-specific password.
• Mailstone keeps the password in Obsidian's secret storage.
• MailDump can ask for your app password each time instead of saving it.
• Email to Vault has an IMAP mode, desktop only.

What to watch for

If a password lives in plain text in your vault, anyone who can read your vault files can read it. That includes any synced or backed-up copy of the .obsidian folder. App-specific passwords limit the damage, because you can revoke one at your email provider without changing your main password.

Work accounts add another wrinkle. Some organizations turn off IMAP access or app passwords entirely, so check before you plan around it.

How forwarding works

You forward or send specific emails to an address. The service holds each one until the plugin fetches it into your vault. Your mailbox is never connected, so the service only ever sees what you chose to send.

Here's how that works with Email2Obsidian specifically:

• We only accept mail from your authorized senders: your account email plus up to 3 more, each verified by a confirmation email. Everything else is ignored.
• Email content is kept for up to 72 hours, only so the plugin can fetch it, then deleted.
• Our servers are at Hetzner in Germany.
• Our sub-processors are Cloudflare (firewall), Stripe (payments), Resend (email delivery) and Google (analytics and email communications).
• The plugin authenticates with an API key from your dashboard, not your mail password. You can have up to 5 keys at once, and each expires after 3, 5 or 12 months.

One thing to be clear about. Forwarding sends a readable copy of the email to the relay. That includes mail you decrypted in Proton or a similar encrypted service. If a message should never leave your provider in readable form, don't forward it anywhere.

Not every forwarding option works the same way, either. At the time of writing (November 2026), Email to Vault's Mail.tm mode routes mail through a disposable-mail service that may keep it for up to 7 days, and its listing advises against sending sensitive data. Retention and sender rules are worth checking for any relay.

Side-by-side

Choose IMAP if…

• You don't want any third-party relay to handle your email.
• You want everything from certain senders captured automatically, newsletters included, by filing it into a folder.
• You only capture on desktop and you're comfortable managing app passwords.

That's a perfectly reasonable choice, and for some people it's the right one. A forwarding service can't match "my mail never leaves my provider."

Choose forwarding if…

• You don't want to give any tool your mailbox login.
• You capture from your phone, or from a work machine where you can't install IMAP tools.
• You want to choose each email yourself, so your vault only gets what's worth keeping.

On the automation side, be realistic: with Email2Obsidian, automatic Gmail forwarding isn't supported today, because Gmail keeps the original sender and we only accept mail from you. An Outlook "Forward to" rule can work where your organization allows external forwarding. Here's how to forward from Gmail, Outlook and Apple Mail, and how to capture from your phone by email.

A 6-point safety checklist for any email-to-Obsidian tool

1. Where does mail travel? Straight from your provider, or through a relay? Whose relay, and in which country?
2. How long is it kept? Look for a stated retention window, not "until fetched."
3. Who can send to it? An address anyone can mail is an address anyone can fill with junk.
4. Where do credentials live? Plaintext in the vault, secret storage, or not stored at all? Can you replace them easily?
5. Desktop, mobile or both? Think about where you actually are when an email worth keeping arrives.
6. What happens if you cancel? Do your notes stay as plain files, or are they locked in another app?

Prefer not to share your mailbox password? Start free with 10 emails, no credit card, or read our privacy details first.

How to keep a forwarding address safe

A few habits go a long way:

• Treat the address like a password. Don't post it or share it, even though we only accept mail from your authorized senders.
• Authorize only addresses you own. You get up to 4 in total, each verified.
• Rotate API keys. Pick a 3, 5 or 12-month expiry, and use a separate key per device if that helps you keep track.
• Check your employer's policy before forwarding work mail outside the company.
• Follow your ethics rules if you handle research participant data. Some of it shouldn't be forwarded at all.

For more detail, see how we handle and delete your email, or compare specific tools in every Obsidian email plugin compared.

Obsidian and the Obsidian logo are trademarks of Dynalist Inc. This site is unaffiliated. Other product names belong to their owners and are used only to describe compatibility and differences. Spotted something out of date? Email [email protected] and we'll fix it.