Open-source webmail, honestly reviewed. Not the email server you’re imagining — but probably the interface your hosting already ships.

TL;DR

What it is: A browser-based IMAP webmail client written in PHP — not an email server, just the web interface on top of one [homepage].
Who it’s for: Sysadmins who already run an IMAP server (Dovecot, Postfix, Mailcow) and want a browser-based UI for users. Also anyone whose shared hosting already bundles it [1][2].
Cost savings: Google Workspace runs $6/user/month. A self-hosted mail stack with Roundcube costs $5–15/month on a VPS regardless of how many users you add.
Key strength: Rock-solid IMAP client with 20+ years of deployment history. Used by cPanel, DirectAdmin, and Plesk as their default webmail — it’s genuinely battle-tested [homepage].
Key weakness: Roundcube is a frontend, not a complete solution. You still need a working IMAP and SMTP server underneath it. The UI, while functional, has not caught up to modern email clients [4].

What is Roundcube

Roundcube is a browser-based webmail client. That sentence is doing a lot of work, so it’s worth being precise about what it is — and what it isn’t.

Roundcube does not handle email delivery, storage, or routing. It doesn’t come with a mail server. What it does is provide a web interface that connects to an existing IMAP server and an SMTP server for outgoing mail. You log in through your browser and get a desktop-application-style experience: reading, composing, organizing, searching, contacts — all in the browser [homepage].

The project describes itself as “a browser-based multilingual IMAP client with an application-like user interface” [homepage]. That’s an accurate description. It’s been in active development since roughly 2005, making it one of the longest-lived open-source webmail projects still receiving regular releases. Version 1.6.14 shipped in March 2026 as a security update, and the 1.7 release candidate series has been running through early 2026 with RC5 out in March [homepage].

The reason most people have already used Roundcube without realizing it: it’s the default webmail interface shipped with cPanel, DirectAdmin, and Plesk — three of the most common shared hosting control panels. If you’ve ever clicked “Webmail” on a shared hosting account, there’s a reasonable chance you were looking at Roundcube [2][1].

GitHub puts it at 6,859 stars. That number understates the actual installed base. Roundcube’s distribution is measured in millions of deployments embedded in hosting infrastructure, not in GitHub stars from developers installing it manually.

Why people choose it

The decision to use Roundcube rarely comes from a direct product evaluation. It falls into three categories:

It came with the server. Hosting providers — Versio, Flexwebhosting, PCextreme, and hundreds of others globally — bundle Roundcube as their default or one-of-several webmail options [2][1]. For most users, they clicked “Webmail” and Roundcube appeared. This is how Roundcube achieves its distribution: not through enthusiasm, but through being pre-installed infrastructure.

You’re running your own mail stack and need a web frontend. If you’ve deployed Mailcow, Mailu, Mail-in-a-Box, or a custom Dovecot/Postfix stack, you need something for users who won’t use a desktop client. Roundcube is the obvious choice — mature, well-documented, actively maintained, and not trying to do more than it should.

You need LDAP integration. Roundcube’s address book has native LDAP connector support, which makes it one of the few open-source webmail clients that fits naturally into organization directory setups. Lighter alternatives like Snappymail don’t match this depth [homepage].

What people do not typically say is “I chose Roundcube because of the UI.” The interface is functional and familiar — three-column layout, threaded messages, attachment management — but it’s not a design that wins comparisons against Fastmail, Hey, or ProtonMail.

Features

Based on the official feature documentation and about page:

Core email:

Drag-and-drop message management [homepage]
Full MIME and HTML message support [homepage]
Multiple sender identities per account [homepage]
Threaded message view [homepage]
IDNA and SMTPUTF8 support for international email addresses [homepage]
Shared and global IMAP folders [homepage]
Access control lists (ACL) on folders [homepage]
Built-in caching for faster mailbox access [homepage]
Canned response templates [about]
Attachment previews [about]
Spell checking via integrated library [about]

Contacts:

Full-featured address book with groups [homepage]
LDAP connector support for corporate directories [homepage]
Find-as-you-type address book integration when composing [homepage]

Security:

XSS attack protection [homepage]
PGP encryption support via plugin [homepage]
OAuth/XOAuth login support [about]
Brute-force login attempt prevention [about]
No external resource loading by default — images are blocked until you allow them [about]

UI and accessibility:

Available in over 80 languages [about]
Three-column layout [about]
Responsive Elastic theme with light and dark modes [about]
Multi-device support [homepage]
Import/export functions [homepage]

Extensibility:

Plugin API — plugins published as Composer packages on Packagist [about]
Sieve/Pigeonhole filter support via plugin, enabling server-side email rules [3]
Template system for custom skins [about]
Third-party plugins include calendar, two-factor authentication, advanced search, and keyboard shortcuts [about]

What it doesn’t include natively: a mail server, calendar server, spam filter, or user management. Those are your mail stack’s responsibility. Roundcube is a display and interaction layer.

Pricing: SaaS vs self-hosted math

Roundcube itself is free software. There is no Roundcube cloud tier, no per-user fee, and no commercial agreement required. The GPL v3 license with exceptions for plugins and skins means you can deploy it freely [README][homepage].

The real cost is your mail infrastructure:

What you’re replacing:

Google Workspace Business Starter: $6/user/month. A 10-person company pays $720/year.
Microsoft 365 Business Basic: $6/user/month. Same math.
Fastmail: $5/user/month for standard. A 10-person company pays $600/year.
ProtonMail Business: ~$7/user/month.

Self-hosted with Roundcube:

You don’t deploy Roundcube in isolation — you deploy a mail server plus Roundcube. Realistic options:

Mailcow or Mailu (Docker-based full stacks that can include Roundcube or a compatible frontend)
A VPS: $5–15/month on Hetzner, Contabo, or DigitalOcean depending on load

That’s $5–15/month flat, regardless of user count. For a 10-person team currently paying $720/year on Google Workspace, the savings are real — roughly $600–700/year after VPS costs. For a 50-person team paying $3,600/year, the gap becomes serious money.

The asterisk: email is the service you can least afford to lose. Self-hosting means you own uptime, deliverability, and backups. If email stops at 2am, that’s on you. Factor in either the operational confidence to run it yourself, or the cost of a managed deployment service.

Roundcube also has no commercial support offering of its own. Support comes from the community, your hosting provider, or whatever your mail stack vendor offers.

Deployment reality check

Roundcube requires a full LAMP-adjacent stack to function:

Web server (Apache, Nginx, or similar) with PHP 7.3+ [about]
Database: MySQL/MariaDB, PostgreSQL, or SQLite [about]
An IMAP server (Dovecot is most common)
An SMTP server for outgoing mail
Roundcube itself

Most people deploying Roundcube aren’t installing it on a bare VPS from scratch — they’re using it as part of a full mail stack, or it comes pre-installed with a control panel. In those contexts, Roundcube just works.

Manual installation is a different story. A French forum thread [4] documents a typical sequence of installation failures: first the PHP timezone configuration blocks progress (the date.timezone setting was commented out in php.ini — a single semicolon caused the entire installer to halt). Then database permission errors. Then directory write permission failures for the temp/ and logs/ directories. Each failure requires a different fix. None of these are Roundcube bugs — they’re standard LAMP configuration tasks — but for a non-technical user, each one is a wall.

Sieve server-side filtering is a good example of the “not included, needs wiring” pattern. The Pigeonhole plugin enables email filters (auto-archive by sender, auto-forward, etc.), but requires Dovecot-side configuration and a separate build process if you’re on DirectAdmin. The plugin itself works reliably once the server side is in place [3], but there’s real setup effort involved.

Also worth noting from the security releases: Roundcube ships security updates regularly and explicitly warns users about phishing emails impersonating Roundcube [homepage]. The project takes security seriously, but it also means you need to keep up with patches on a self-hosted instance.

Realistic time estimates:

As part of Mailcow, Mailu, or a control panel: webmail is already configured, zero effort
Manual install for a sysadmin: 1–3 hours including database setup and configuration
For a non-technical user following a guide: a full day, including working through two or three configuration failures [4]

Pros and cons

Pros

20+ years of production deployment. Running in millions of shared hosting environments. Security vulnerabilities get patched quickly — 1.6.14 was a security update in March 2026 — and the codebase has been hardened over decades [homepage].
GPL v3 license. Free to use, deploy, modify, and distribute. No “fair-code” restrictions, no commercial tiers hiding basic features [README].
LDAP address book support. One of the few open-source webmail clients with solid native LDAP connectors. Critical for organizations with existing directory infrastructure [homepage].
Rich plugin library. Calendar, two-factor authentication, S/MIME, Sieve filtering, keyboard shortcuts, many skins — all available via Packagist [about].
PGP and OAuth support. Encryption and modern authentication at the plugin level [homepage].
Over 80 languages. Genuine internationalization for deployments outside English-speaking markets [about][1].
Active development. A 1.7 release candidate series through early 2026 confirms the project is not in maintenance mode [homepage].
Pre-installed on major control panels. Zero friction if you’re on cPanel, DirectAdmin, or Plesk [2].

Cons

Not a complete email solution. You need a full mail stack — SMTP, IMAP, DNS, spam filtering — underneath it. Roundcube is the window, not the house [homepage].
UI shows its age. The Elastic theme is clean by 2015 standards. Compared to Fastmail, Hey, or ProtonMail, the interface is functional but not polished. No snooze, no quick keyboard navigation, no AI-assisted features that users increasingly expect.
Manual setup requires real sysadmin knowledge. Timezone settings, database permissions, directory write permissions — documented failures are common for anyone not using a control panel or Docker stack [4].
No built-in spam filtering. Spam handling is your mail server’s job. Roundcube displays whatever the IMAP server delivers.
Mobile experience is adequate, not excellent. The responsive skin works, but it’s not a purpose-built mobile app.
Community support only. No paid support tier from the Roundcube project itself [homepage].
Sieve filtering requires server-side setup. The Pigeonhole plugin is useful, but requires Dovecot configuration outside Roundcube before it does anything [3].
No managed cloud option. There’s no try-before-you-deploy option. You run it yourself or you don’t use it.

Who should use this / who shouldn’t

Use Roundcube if:

You’re running your own mail server and need a stable, battle-tested web interface for users.
Your organization uses LDAP for directories and wants webmail with native connector support.
Your shared hosting already ships it and there’s nothing to configure.
You’re deploying for a multilingual user base — 80+ languages is a real advantage.
You want a GPL-licensed webmail frontend you can customize, skin, and extend without legal overhead.

Consider Snappymail instead if:

You want a lighter, faster, simpler webmail interface without LDAP requirements. Snappymail (the actively maintained RainLoop fork) has a cleaner modern UI and lower server requirements.

Consider Sogo instead if:

You need shared calendars, contacts, and tasks alongside email with full CalDAV/CardDAV server support. Sogo is heavier but covers the full collaboration stack.

Consider Horde instead if:

You want a complete groupware suite — calendar, tasks, notes, file manager — in a single webmail package. Horde is more complex but more feature-complete [1].

Skip self-hosting entirely if:

Your team is non-technical and you’d need to hire someone to maintain the mail server. Email deliverability and uptime require real operational attention.
Your compliance requirements need audited, SLA-backed email. Google Workspace and Microsoft 365 have certifications that a self-hosted stack doesn’t come with.

Alternatives worth considering

Snappymail — the actively maintained RainLoop fork. Cleaner modern UI, lower overhead, less LDAP depth. Good for personal or small team deployments.
Sogo — full groupware with CalDAV/CardDAV server. More complex to deploy, but covers shared calendars and contacts properly.
Horde — older groupware suite, heavy but feature-complete. Available as a webmail option alongside Roundcube on many hosting panels [1][2].
SquirrelMail — the prior generation of PHP webmail. Still mentioned in some hosting docs [2] but development is essentially dead. Avoid for new deployments.
Zimbra — full email and collaboration platform with an open-source community edition. Much heavier infrastructure requirement [1].
AfterLogic WebMail — commercially-licensed option with a polished UI; free for personal use with limitations.
Fastmail / ProtonMail — managed SaaS alternatives. Real cost per user but real operational peace of mind and modern UX.

Bottom line

Roundcube is the kind of software that earns trust by doing one thing reliably for twenty years. It’s a webmail frontend, not an email server — a distinction that trips up people expecting a turnkey solution. If you already have a mail stack and need a web interface, Roundcube is the safe, mature, actively-maintained answer. If you’re starting from zero, you need to pair it with Mailcow, Mailu, or a similar full stack before Roundcube becomes relevant. The UI isn’t winning design awards, and manual setup without a control panel requires genuine sysadmin patience. But for a self-hosted team looking to cut $600–3,000/year in SaaS email costs, the operational overhead is manageable — and Roundcube’s stability is the kind you only get from a project that has been running in production for two decades.

If setting up the mail stack is the blocker, that’s exactly what upready.dev deploys for clients — one-time setup, you own the infrastructure, no recurring bill tied to a vendor.

Sources

Versio.nl — “Alles wat je moet weten over Roundcube!” (What you need to know about Roundcube: features, alternatives, setup overview). https://www.versio.nl/artikelen/alles-wat-je-moet-weten-over-roundcube
Versio.nl — “Inloggen op de webmail” (Webmail login guide covering Roundcube in cPanel/DirectAdmin/hosting panel context). https://www.versio.nl/kennisbank/e-mail/inloggen-op-de-webmail
Versio.nl — “Pigeonhole voor Roundcube installeren” (Installing Pigeonhole Sieve filter plugin for Roundcube via DirectAdmin and Dovecot). https://www.versio.nl/kennisbank/e-mail/pigeonhole-voor-roundcube-installeren
forum.commentcamarche.net — “Problème de configuration de roundcube — Ubuntu” (Forum thread documenting real installation failures: PHP timezone configuration, database permissions, directory write errors). https://forums.commentcamarche.net/forum/affich-28644143-probleme-de-configuration-de-roundcube
forum.pcastuces.com — “RoundCube comment le supprimer” (Forum thread documenting ISP Free.fr migrating users to Roundcube as default webmail without opt-in). https://forum.pcastuces.com/roundcube__comment_le_supprimer-f6s68827.htm