iCloud Hide My Email Manager

• Interactive TUI list — Real-time search, arrow key navigation, and inline detail view
• Full alias management — Create, edit, deactivate, reactivate, and delete aliases
• Bulk operations — Deactivate or delete multiple aliases at once
• Export — Save all aliases to CSV or JSON
• Clipboard support — Copy an alias address with a single keypress
• Apple SRP authentication — Secure login with 2FA support
• Encrypted sessions — Session data is AES-256-GCM encrypted on disk
• Standalone executable — No runtime required, just download and run
• Cross-platform — Windows, macOS, and Linux

Grab the latest executable for your platform from Releases:

No Node.js or any other dependency required — just download and run.

If you prefer to run from source:

git clone https://github.com/Yimikami/icloud-hme-manager.git
cd icloud-hme-manager
npm install
npm start

Requirements (source only): Node.js 18+ and an active iCloud+ subscription.

On first run the app will ask you for three things:

1. Session passphrase — a password you choose to encrypt your session locally
2. Apple ID & password — used once for authentication
3. 2FA code — sent as a push notification to your trusted Apple devices

After the initial login your session is cached and encrypted. You only need to enter your session passphrase to get back in.

The session passphrase is a password you choose on first run. It encrypts your iCloud session data (cookies, tokens) on disk using AES-256-GCM. Think of it as a master password for the app.

• First run: Pick any passphrase → login with Apple ID → session encrypted
• Next runs: Enter the same passphrase → session decrypted → no login needed
• Wrong passphrase: Session can't be decrypted → option to retry or login again
• Session expired: Re-authentication with Apple ID required

Session data is stored in your OS data directory:

Apple ID + Password
        |
   SRP Protocol  ──>  idmsa.apple.com
        |
   2FA Push      ──>  Trusted Device
        |
   Session Token ──>  setup.icloud.com/accountLogin
        |
   HME API       ──>  maildomainws.icloud.com

1. SRP handshake via @foxt/js-srp — password never leaves your machine in plaintext
2. 2FA verification pushed to your trusted Apple devices
3. Session cookies encrypted with AES-256-GCM using your passphrase
4. API calls to iCloud's maildomainws service for alias management

• icloud-hme-extension — Browser extension to generate and autofill iCloud+ Hide My Email addresses into any website

MIT