POP3
The Post Office Protocol Version 3 (POP3) is a simple, widely-supported protocol for retrieving email from a remote server to a local client. It is designed for offline access — the client downloads messages and typically deletes them from the server (though a “leave on server” option is common). For online, multi-device access, imap is the modern standard.
POP3 was specified in RFC 1939 (May 1996), with extensions defined in RFC 2449. It runs over TCP port 110 (cleartext / STLS) and port 995 (implicit TLS, POP3S).
Core commands
POP3 uses a simple request–response model. Replies are single-line status indicators (+OK or -ERR), sometimes followed by multi-line data. The minimal command set to authenticate and pull mail:
| Command | Purpose |
|---|---|
USER username | Send username for authentication |
PASS password | Send password for authentication |
STAT | Return mailbox statistics (+OK <total_msgs> <total_size>) |
LIST [msg] | List message numbers and sizes |
RETR <msg> | Retrieve full message text |
DELE <msg> | Mark message for deletion |
QUIT | Commit deletions and close connection |
Optional extensions (RFC 2449) include TOP (retrieve headers only), UIDL (unique message IDs), and CAPA (server capability discovery).
Security notes
- Cleartext credentials —
USER/PASSare sent in the clear on port 110; use POP3S (port 995) or theSTLSextension to upgrade to TLS. - No message integrity — POP3 has no built-in integrity or confidentiality guarantees; TLS is mandatory for any real deployment.
- Limited functionality — POP3 cannot create server-side folders, set flags, or search; all of that is client-side.
Related: imap (online mail access), smtp (mail transmission), openssl-s-client-command-injection (TLS-wrapped service testing).