Security & Encryption

Last updated: 29 June 2026 · applies to app v1.26+

Forwardit runs entirely on your phone. There is no Forwardit server, no account, and no analytics. Your messages never reach us — they go only to the destinations you choose (your email or your own backup phone). Your message content and your email credentials are encrypted on your device.

100% on your device

There is no Forwardit backend that receives your messages. The only outbound connections the app makes are:

to your own email (SMTP) server, to deliver a forward;
the carrier SMS channel, to deliver a forward to a backup phone;
Google Play Billing, for subscriptions.

Nothing is sent to Forwardit. The app contains no analytics, tracking, ads, or crash-reporting SDK. If the app ever crashes, the report is written to a private file on your device and is only ever sent if you choose to email it.

What is encrypted on your device (at rest)

The following are encrypted with AES-256-GCM, using a key held in the Android Keystore (hardware-backed on supported devices). The key never leaves your phone and is not included in any backup:

Your email (SMTP) password — and it is excluded from cloud backup entirely;
Your SMTP server host, port, and login email;
The forwarded message content;
Who the message came from (the sender);
The destination each message was forwarded to;
The channel used to send (which SIM, or which email);
The short-lived processing-queue copy of a message held while it is being delivered.

This means both the brief copy Forwardit holds while delivering a message and your entire forwarding history are stored as unreadable ciphertext on disk.

What is encrypted in transit

Email forwarding uses an encrypted TLS/SSL connection to your mail server (you choose TLS or SSL in setup).
SMS forwarding to a backup phone uses the normal carrier SMS channel. Like all SMS, this is carrier-grade transport, not application-level encryption — we do not claim SMS forwards are end-to-end encrypted.

What is not encrypted — and why

We prefer to be precise rather than over-claim:

Your forwarding rules and the destinations you configure (filter names, match rules, and the email or phone you forward to) are stored as ordinary local data so that Android can restore your setup when you get a new phone. If they were encrypted with the device-bound key, they could not be restored on a different device. They live only on your phone and in your own private Google account backup — they are never sent to Forwardit.
App settings (theme, language, toggles) are likewise plain local data.

In short: your message data and credentials are encrypted; your configuration is kept restorable — and none of it is ever transmitted to us.

Cloud backup

Android may back up app data to your own Google account (you control this in Android Settings):

Included: your forwarding rules and settings (so a new phone restores your setup), and your forwarding history — but the message content, sender, and destinations within it remain ciphertext in the backup.
Excluded: your SMTP credentials are never backed up. After restoring on a new phone you simply re-enter them once.

Device access protection

Sensitive actions — viewing your saved SMTP password, editing or deleting credentials, deleting filters, and clearing the log — require your fingerprint or device PIN. Forwardit also offers an app lock.

Encryption methods (for reviewers)

Symmetric cipher: AES-256-GCM (authenticated encryption).
Key storage: Android Keystore — hardware-backed where supported; keys are non-exportable and device-bound.
Credentials store: Android EncryptedSharedPreferences (AES-256 for keys and values).
In transit (email): TLS/SSL negotiated with your SMTP server.
No third-party network SDKs are linked into the app (AndroidX, Google Play Billing, and JavaMail only).

Questions

Email dev@forwardit.app — we are happy to answer specifics or walk a reviewer through the details.