Thunderbird Extension

The Thunderbird extension signs messages on send and verifies them on open, across every account configured in Thunderbird. No per-account setup.

Before you start

You need the same prerequisites as the browser plugins:

TrustDID installed — the signed installer on Windows, or the install script on Linux
An activated identity — paid tiers run trustdid-setup --managed YOUR_TOKEN YOUR_ID once (token + UUID from your enrolment email), which pulls the license from the API automatically; Free tier just runs trustdid-setup interactively
The TrustDID Service running (trustdid-service status reports running)

See Software Bundle on Windows or Software Bundle on Linux if you haven't installed the bundle yet.

Step 1: Install the add-on

Thunderbird accepts unsigned XPIs more readily than Firefox, so install is straightforward.

Open Thunderbird.
Tools → Add-ons and Themes (or Ctrl+Shift+A).
Click the gear icon → Install Add-on From File....
Pick TrustDID-Thunderbird-v1.2.3.xpi.
Click Add when Thunderbird prompts.

A small TrustDID shield appears in the message read pane and in the compose window's toolbar.

Step 2: Configure the add-on

Add-ons and Themes → TrustDID → Options.

API URL — https://localhost:8080 (default)
Auto-sign on send — on by default. Every outgoing message gets a .vrfy sidecar attached automatically.
Auto-verify on open — on by default. Incoming signed messages show a green / amber / red shield.
Footer signature — appends a one-line "Verified by TrustDID" footer to signed messages.
Language — EN/FR

Step 3: Sign your first message

Click Write.
Compose a short message.
Click Send. With auto-sign on, signing happens silently. With auto-sign off, click the shield in the compose toolbar before sending.

The recipient gets your message plus a small .vrfy attachment. Anyone with a TrustDID-aware mail client (or our online verifier) can confirm the signature.

Step 4: Verify a received message

When you open a signed message, the shield reports two independent answers — document authenticity ("is it genuine?": Verified / Inconsistent / Failed / Unsigned) and trusted signer ("who vouches for it?": Yes / No / Unknown):

Green shield in the read pane — authenticity Verified: the signature verifies, the sender's DID is published, and the sender matches the From header.
Amber shield — the signature verifies but something is off (mailing-list rewrite, From mismatch). Click for details.
Red shield — authenticity Failed, or the .vrfy sidecar is missing or tampered with.

The trusted-signer answer comes from the registries your verifier consults (trustdid-setup --add-trusted-registry) — an authentic message can still show Trusted signer: No if nobody you trust vouches for the sender.

Click the shield itself for the full verification trace.

Troubleshooting

"Couldn't load the extension" on install. The XPI download was corrupted, or your Thunderbird is older than 115. Check Help → About Thunderbird.

Shield never appears. The service isn't running, or the API URL in options is wrong. Hit https://localhost:8080/health in any browser to confirm.

Signing works on one account but not another. The add-on signs from the From header of the outgoing message, not from a fixed identity. Make sure the From address matches a DID you've published (check trustdid status).

"Verification failed: clock skew" on incoming messages. Your system clock is more than five minutes off. Sync it (w32tm /resync on Windows, timedatectl set-ntp true on Linux) and re-open the message.

Need help?

Tools → Developer Tools → Error Console in Thunderbird, reproduce the issue, and copy any "TrustDID:" log lines to support@trustdid.ca with your Thunderbird version.