Betterbird Blog

It has been brought to our attention via this Reddit post that the author of Quicktext is blocking use in Betterbird in the future via this commit. The add-on code now checks explicitly for use of the add-on in Thunderbird. This will become effective from add-on version 6.7.

We'll leave it to the assessment of the reader, whether this was done in the best spirit of collaboration in the open source world.

The mentioned Reddit article suggests the use of Clippings for Thunderbird. We tried it, it works.

We know that Quicktext is heavily integrated into some people's workflow, so unless the add-on author drops his stance, we will consider forking the add-on just to adjust the unnecessary checks for Betterbird. That new version would need to be published with a different add-on ID, so it doesn't automatically update to new versions of the original. We would also have to remove the donation facility to the original author and will likely make the forked^*) add-on only available to supporters of Betterbird.

John, please reconsider your position! Have you forgotten your comment, when our ThunderHTMLedit add-on wasn't 100% compatible with Thunderbird for a short period due to technical reasons:

From this day on, the add-on ecosystem for Thunderbird and Betterbird is not the same anymore. There are now cases were add-ons work in Betterbird, but not in Thunderbird. That was not our choice. [...] But it is unlikely that the [ThunderHTMLedit] author is going to release an update, since he does not support Thunderbird anymore.

Of course we fixed the add-on for both Betterbird and Thunderbird. Now, who's going ahead and making his add-on deliberately incompatible?

Update 1: Open source collaboration continues (NOT!) by preventing us from forking the add-on: We were also banned from filing issues or adding comments the the Quicktext GitHub repository.

Update 2: We've now published the latest Quicktext version (which has a bug in the menu on the compose window) here on our website.

Update 3: The Quicktext author reverted the change that made his add-on incompatible. This is available on GitHub as 6.7.2.

We've shipped Betterbird 140.10.0esr-bb21 today. Please refer to the Release Notes for full details.

As the new ESR version 153 is already on the horizon being scheduled for the 21st of July 2026, development of the current ESR 140 has somewhat slowed down. The Thunderbird folks are not shipping anything in their 140.10.0 apart from security fixes in the Mozilla platform and more complete localisations.

We're shipping Betterbird for the first time in Portuguese from Portugal. This was made possible be the tireless effort or volunteer Hugo from North-Portugal. Portuguese is tricky, they have a polite verb forms, like German, French, Spanish and many other languages, and they had a orthography reform in 1990, which wasn't widely accepted, so people still use the old spelling. Thunderbird opted for the polite form and adherence to the reform, so we needed to adopt the same, much to the discontent of our translator who argued that the familiar verb forms are more adequate in today's Portugal. He also had to fix the Thunderbird localisation for Portuguese, so Betterbird (and Thunderbird) can now ship a proper localisation without "English patches" here and there. Thank you, Hugo!

By popular demand, we've changed the icon for CardDAV address books to make them more distinguishable:

Lastly, we fixed a long-standing issue with permanently decrypted PGP messages. After Thunderbird removed this feature in version 78, we implemented it in Betterbird 91, and Thunderbird followed in version 102. However, when decrypting a signed and encrypted message, the signature wasn't shown as valid any more. This has now finally been fixed:

Note that from version 115, signed and encrypted messages use a "combined" MIME layer, so when decrypting the signature is lost regardless. Therefor the fix only applies to messages created before version 115 or those which are now created forcing separate MIME layers with preference mail.openpgp.separate_mime_layers.

Thunderbird has always been underperforming when measured against its own roadmaps. Now it looks like the roadmaps have been replaced by a list of what the project is working on anyway.

Let's compare the past and current roadmaps. We're focusing on the major items which have accompanied us over the last five years, of which at time of writing (April 2026) none are complete and only one, Exchange support, has a realistic chance of being completed.

Items marked with an asterisk for 2026 (Fluent, Exhange) may be complete for the summer release of Thunderbird 153, the global database will not be shipping in this release.

Important items, like replacing the buggy 26-year-old MIME library of finally providing a decent and contemporary mail editor, are not even on the roadmap.

It's no surprise that things are not progressing with the Thunderbird desktop development, since despite close to 60 staff (of whom 15 are managers, CEO, COO or directors), the project has "diversified" into Thunderbird for Android (rebadged K-9 app), Thunderbird for iOS and so-called "Services" where the project actually supplies mail accounts. A developer recently wrote that the desktop team was small; going by the mentioned page and not counting director/manager and release engineer, there are only 12 people.

We've shipped Betterbird 140.9.0esr-bb20 today. Please refer to the Release Notes for full details.

Here are three important new features and changes:

We improved the "delayed sending" capability by making sure that a message which is scheduled for sending is in fact not sent once it's opened for further edits with "edit as new message".

Betterbird/Thunderbird allows to convert an e-mail message to a calendar event or task. The original message is linked to the event/task. However, that link wasn't reliably displayed. That was fixed and we added a button Open in Folder (see screenshot) that allows to go back to the original message.

Lastly, localised versions, like the German version, no longer include the standard Mozilla English US dictionary. We had users who expressed that they wanted to remove the dictionary, which wasn't possible. Also, it allows more flexibility in choosing an English dictionary. Here are some choices:

• The stock-standard Mozilla dictionary, which is rather basic.
• The English US dictionary maintained by Marco Pinto.
• The British English dictionary maintained by Marco Pinto which is the better choice for European use.

If you read the article about discontinuing the Revolut payment link, you will already have heard of credit card testing attacks: Fraudsters effect (small) payments to "merchants" to test the validity of stolen/leaked credit card details. As you can see in the picture, nine attempts were made within less than 40 minutes. All Revolut did was to block our account, they don't offer any mitigation tools.

As of March 2026 our Stripe payment USD link also came under attack. It started with small payments between $0.50 and $2, which we blocked, but later they increased to $5 to $20, and even payments of $100 or $1000 were "tested".

To mitigate the issue the following measures were taken on top of Stripe's so-called Radar which has its own heuristic for fraud detection:

• Small donations blocked
• Donations from Algeria blocked, there seems to be a nest of fraudsters
• Now requiring 3D Secure payments (when available)
• Stricter address checking
• USD payment replaced twice and all payment links now obfuscated (supplied via JS on page load or user click)
• Proactive refund of suspicious payments, since every dispute carries a fee of $20
• Last not least: The Link payment method was disabled, a Stripe invention, which makes these attacks faster for the fraudsters.

Unfortunately, Stripe's own mitigation isn't very good, in on case there were at least 8 failed tests from the same IP address within 33 minutes, and Stripe still allowed a subsequent payment from that IP address, which of course we refunded immediately to avoid a costly dispute:

On this topic, Stripe support made the following statement: Stripe is first and foremost a payments processor. We facilitate your interaction with the card networks and issuers, and we provide a PCI compliant way to do so. Payment processing is not the same as dedicated fraud protection. We do have safeguards against fraud, and we do try to weed out risky transactions without blocking legitimate charges - it's a pretty delicate balance. There's simply no algorithm that can replace the role of the merchant's manual review of orders. But even these powerful, dedicated solutions are not foolproof; the strongest, and best, line of defense is still manual review.

If your genuine donation in USD was declined, please get in touch and we'll find a different payment option. In a dialogue with a donor we found out that Bank of America generally allows outgoing ACH payments. For "regular" customers they charge a fee, it's free for customers with a "preferred status".

Strange what tasks arise in an open source project which aims at providing the world's best e-mail client.

We've shipped Betterbird 140.8.0esr-bb19 today. Please refer to the Release Notes for full details.

This new release offers four new functions and a fix for an annoying issue. Here are some details:

The add-on Send Later to schedule sending of messages has many users. Its author doesn't test his add-on in Betterbird, instead he publishes this disclaimer (quote):

Send Later is known to have issues with Betterbird
The Send Later add-on is not regularly tested with the Thunderbird fork called Betterbird, and there are known, unresolved issues which may prevent the add-on from functioning as intended. Using Send Later with Betterbird is therefore not recommended.

We're not aware of any issues, other than the ~55 issues the add-on has anyway. But the good news is, delayed sending in the background is now supported in Betterbird, if you set the following two preferences:

mailnews.sendInBackground set to true and mailnews.sendInBackground.DelayMinutes set to the desired delay in minutes. Be aware that if you close Betterbird before all messages are sent, there is currently no warning.

This is not aimed at replacing the add-on completely, it's aimed at providing a "send delay" that users of MS Outlook are used to.

As we detailed in previous posts like this one, we're now signing our Windows binaries with a code-signing certificate from a reputable source.

By popular demand, the 'Search PreferredSearchEngine for "..." ' option is now also available in the context menu in the compose window.

People who have used Thunderbird for a long time will know that for IMAP accounts, messages read on the server with a different client, like a mobile device, were not subjected to message filtering. That was later changed by introducing preference mail.imap.filter_on_new. However, the filter didn't work when it was run after the junk classification. This has now been fixed.

Thunderbird released version 140.7.2 yesterday to follow Firefox 140.7.1 which fixes a security issue, a heap buffer overflow in libvpx. That's a video codec. The Thunderbird folks wrote this in their advisory:

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

So, only Betterbird users who use Betterbird as a web browser, or browsing news feeds with embedded videos may be affected. Since the security risk is extremely low and since Betterbird 140.8.0esr-bb19 will ship before the 24th of February 2026, we decided to skip this release.

The "colourful" picture shows the all the test failures that occurred in Thunderbird's release automation and are shown in the so-called "treeherder" (dashboard). Each orange box is a test failure, and it's not advisable to ship the product with so many test failures without investigating them.

In other words: Even if we had built Betterbird based on this Thunberbird release, it could be quite broken. BTW, this is not the first release chagrin, refer to these earlier articles [1] and [2] for more.

Update: Apologies to the Thunderbird folks for the incorrect statement above. We heard that the test failures were analysed and that they came to the conclusion that despite what was displayed on the dashboard, the product showed no functional failures and was safe to ship. That was confirmed by their QA team, in fact, we also tested that Thunderbird release and didn't see failures.

Our article was overreacting to the fact that in the past, test failures were ignored and the product did get shipped with minor functional issues.

Three days ago we noticed a number of 1 € payments via our Revolut payment link using a credit card. We were wondering what this was about.

Today we received this message from Revolut: It is with regret that we must inform you of our decision to discontinue the support for your freelance activity. [...] in an effort to mitigate potential risks associated with providing you with our acquiring services, we have temporarily restricted fund withdrawals from your account for the next 90 days.

Wow! AI sprang to help to explain that our payment link had become the targe of a so-called credit card testing attack, where the link was used by fraudsters to test stolen credit cards. AI went on to say:

What Stripe actually does (and Revolut doesn’t)

• aggressively rate-limits payment attempts
• runs real-time card testing detection
• blocks suspicious patterns before they hit the merchant
• absorbs the fraud risk by default
• does not punish merchants for being targeted

That’s why Stripe payment links are safe to publish publicly.

What Revolut does instead

• exposes a public card entry page
• performs basic checks
• then pushes all residual risk downstream to the merchant
• treats anomalous traffic as merchant risk

So yes — they look the same on the surface, but they are not in the same category operationally. This is not something a normal user can or should infer.

Update: Revolut chat isn't very helpful, mostly pre-canned and/or AI replies. They say that blocking the account is based on their Payment Processing Service Agreement which also includes these Business Terms, but none of the documents specify a block for 90 days. Neither do any of the ten reasons for suspension in section 7 apply.

So this looks like a Goodbye to Revolut. Adding to this is the poor quality of the data they provide: For some donors, name and e-mail address are supplied, for others, only the e-mail, and for quite a few, only the name, so we can never contact the donors to thank them. Furthermore, there is zero reporting, we have to "scrape" the textual data off the Android screen (using this Copy app).

We've shipped Betterbird 140.7.1esr-bb18 today. Please refer to the Release Notes for full details.

The Thunderbird folks are preparing their 140.7.1 release for next Tuesday, 27th January 2026 to fix a vulnerability in an OpenPGP edge case. Due to scheduling constraints, we're already shipping this now.

Since only 13 days have passed since our Release 140.7.0esr-bb17, this release only contains a few items. By popular demand, we're now distinguishing in the Activity Manager now whether messages were downloaded or not by giving the icon a different colour:

We've also advanced 11 bug fixes the Thunderbird folks are not shipping to their ESR users, refer to our opinion about this policy in this prior blog post.

Placing advertisements on the Thunderbird start page was under discussion years ago when our CEO was still serving on the Thunderbird Council. Back then, request received by certain advertisers were deemed incompatible with the Thunderbird mission.

Of course, the in-product start page is seen by many users, and therefore offers itself to draw attention to hand-picked relevant products or partners. A few days ago, we were contacted by the CEO of Forward Email. This company offers full mail hosting for people who have registered their own domain, or just mail forwarding. As a "test balloon", we agreed to show a recommendation for their products on our start page, to see where the collaboration can lead.

We're going to try out their SMTP service, since the outgoing mail server that comes with our hosting package at the German hosting provider Hetzner sometimes doesn't have the best "reputation", and we end up sending mail via Gmail.

Update: Following Forward Email's instructions, we configured SPF, DKIM and DMARC, and hey, now we have an alternative outgoing server. Definitely a win for our project! Their setup doesn't force you to transfer the MX records to them, so it gives you the flexibility you may need. Disclaimer: We're using a paid plan, so all this is not part of the free plan.

Any users who don't want to see the advertisement can add an ads=no parameter to the Betterbird start page location, so is becomes:

https://www.betterbird.eu/start?ads=no&locale=%LOCALE%&version=%VERSION%&channel=%CHANNEL%&os=%OS%&buildid=%APPBUILDID%

There is also a dark version of the start page:

https://www.betterbird.eu/start/indexd.php?locale=%LOCALE%&version=%VERSION%&channel=%CHANNEL%&os=%OS%&buildid=%APPBUILDID%

which can be modified to:

https://www.betterbird.eu/start/indexd.php?ads=no&locale=%LOCALE%&version=%VERSION%&channel=%CHANNEL%&os=%OS%&buildid=%APPBUILDID%