Provider settings and the gotchas.

The connection runs over HTTPS. Before a job is queued, the credentials are encrypted for the worker: the plain password is never stored, only an encrypted package is kept for a while. It is decrypted in the worker’s memory and passed to the imapsync process through the environment. The password never shows up in the logs, and you enter it again for a rerun. If that model is not enough, there is the self-hosted version, where the password goes to your own mail servers and no MoveMailbox infrastructure is involved.

One whole mailbox measured at 5 GB or less moves for free. We will not copy the first 5 GB of a large mailbox and then stop out of the blue.

In the hosted version the job runs on our worker and keeps going after you close the tab. The local Windows client has to stay open.

Start it again. imapsync checks what is already on the destination and copies only what is missing — a rerun is cheap and creates no duplicates.

The work and the traffic are handled by the user’s own machine, so the commercial MoveMailbox Cloud limit does not apply. Provider-side limits still do.

No. The default scenario is a one-way copy. Only delete the old mailbox after checking things by hand and letting a grace period pass.

Any compatible IMAP server. Gmail, Microsoft and some corporate systems may require an app password, IMAP to be switched on, or OAuth.

Yes. The original RFC-822 object is moved whole: headers, date, attachments, read/answered flags, nested folder structure. Server-side filters, auto-replies and contacts are not moved — they are not part of IMAP.