Are your emails and attachments safe from prying eyes? If you're not using a secure email service that respects your privacy, the answer is likely no. Most large email providers, such as Gmail and Yahoo, do not respect the privacy of your inbox. For example:
- Google is adding ever more ads into your Gmail Promotions section. We're also seeing reports that some people are finding ads interspersed between messages within their inbox.
- Gmail was caught giving third parties full access to user emails and also tracking all of your purchases.
- Advertisers have been allowed to scan Yahoo and AOL accounts to "identify and segment potential customers by picking up on contextual buying signals, and past purchases."
- Yahoo has been caught scanning emails in real time for US surveillance agencies.
In today's digital age, securing your communications has become increasingly important as data breaches and privacy concerns are on the rise. With the average person spending over hours managing their work and personal email daily, it's essential to opt for the most secure email provider that prioritizes encryption and privacy. In this article, we present the top 10 secure email providers out there, along with essential factors to consider when choosing the best one for your needs.
Editor's Note:
Guest author Heinrich Long is the editor behind Restore Privacy, a blog dedicated to inform about best online privacy practices, secure your electronic devices, unblock restricted content and defeat censorship.
Big-name email services put lots of money into security, but they are also large targets and not invulnerable. A while back, the big news was the ease with which hackers were able to compromise thousands of Microsoft Exchange email servers. You might well be safer using a smaller, less well-known email service.
On a positive note, there is a relatively simple solution for keeping your inbox more secure: switch to a secure email provider that respects your privacy.
What is the best secure email service in 2024?
With so many different types of users, there is no single service that will be the top choice for everyone, but there are plenty of solid choices. While some users will prioritize maximum security and strong encryption, others may want more convenience and simplicity with user-friendly apps for all devices.
Here are our top recommendations for secure email services:
- Proton Mail – Best for strong encryption
- StartMail – Private email hosted in The Netherlands
- Mailfence – A secure and customizable email service
- Tuta – Secure Email for Any Device
- Mailbox.org – Affordable private German email service
- Posteo – Reliable anonymous email service
- Runbox – Private email in Norway
- CounterMail – Swedish email with strong security features
- Kolab Now – Swiss email, compliant with GDPR, HIPAA, and PCI
- Soverin – Basic private email service
Factors to consider when choosing a secure email service for your needs
Here are a few key factors to consider when switching to a secure email provider:
- Jurisdiction – Where is the service located and how does this affect user privacy? Where is your data physically stored?
- PGP support – Some secure email providers support PGP, while others do not use PGP due to its vulnerabilities and weaknesses.
- Import feature – Can you import your existing emails and contacts?
- Email apps – Due to encryption, many secure email services cannot be used with third-party email clients, but some also offer dedicated apps.
- Encryption – Are the emails end-to-end encrypted in transit? Are emails and attachments encrypted at rest?
- Features – Some features you may want to consider are contacts, calendars, file storage, inbox search, collaboration tools, and support for DAV services.
- Security – What are the provider's safety standards and policies?
- Privacy – In which ways does the email service protect your privacy? What data is being collected, for how long, and why?
- Threat model – How much privacy and security do you need and which service best fits those needs?
The goal of this guide is to help you find the best secure email solution for your unique needs. This list is not in rank order, so choose the best secure email service for you based on your own unique needs.
Here are the most secure email providers in 2024 that will protect your privacy.
1. Proton Mail – Secure email in Switzerland
| Proton.me | |
|---|---|
| Based in | Switzerland |
| Storage | 15-500 GB |
| Free Tier | Up to 1 GB |
| Price | Free – $3.49/mo |
| Website | Proton.me |
Proton Mail is a Swiss email service that enjoys a great reputation in the privacy community. It was started by a team of academics working at MIT and CERN in 2014. Shortly thereafter, it was promoted in American media as "the only email system the NSA can't access" – which was around the time Lavabit was shut down for not cooperating with the US government.
Looking at the service itself, Proton Mail has a lot going for it. It uses PGP encryption standards for email and stores all messages and attachments encrypted at rest on Swiss servers. Proton Mail has a unique feature for "self-destructing messages", address verification, and full PGP support. Recently, it introduced a "Tracking Links Protection" feature which removes tracking pixels from email links.
It also offers end-to-end and zero-access encryption for messages, which means that even the service providers themselves cannot access your content. This is a crucial feature for anyone who values their privacy and wants to ensure their communications remain confidential.
Proton Mail has a stylish and effective design
Regarding encryption, it's important to note that Proton Mail does not encrypt the subject lines of emails or certain metadata. Unfortunately, these are the inherent limitations of the PGP standard. Most of the email services we discuss here use PGP, but I wouldn't count on any of them to protect me from the NSA or their counterparts in other countries.
Additionally, the Proton Mail search function can only search subject lines within your inbox, not the actual content of your emails. This is another functional limitation that comes from integrating more encryption and security into the service. Proton Mail does offer apps for mobile devices (Android and iOS). You can also use Proton Mail with third-party apps through the Proton Mail Bridge feature (restricted to paid users).
Overall Proton Mail is a well-regarded email provider and should be a great secure email option for most users. Switzerland remains a strong privacy jurisdiction that is not a member of any surveillance alliances.
Pros
- End-to-end (E2E) and zero-access encryption for Email, Calendar, and Contact information
- Operates under Swiss jurisdiction
- All data stored on servers in Switzerland
- Apps for Android and iOS mobile devices
- Web client, encryption algorithms, Android and iOS code are all open source
- Support for custom domains
- Strips IP address from emails
- Can be used with third-party email clients through the Proton Mail Bridge feature
- Can import contacts and emails
Cons
- Subject lines not encrypted
- May require personal information for verification of new accounts
2. StartMail – Private email hosted in The Netherlands
| StartMail.com | |
|---|---|
| Based in | The Netherlands |
| Storage | 10-20 GB |
| Free Tier | 7 day trial |
| Price | $5/mo |
| Website | StartMail.com |
StartMail is particularly suited for individuals and businesses that rely heavily on desktop computers for their daily operations. StartMail provides PGP end-to-end encryption and unlimited email aliases. Based in the Netherlands, StartMail servers are well protected, and the service supports two-factor authentication for additional security.
StartMail unlimited email aliases allow you to manage multiple email identities under a single account. This is a handy feature for businesses that need to maintain separate email identities for various departments or projects, or for individuals who want to keep their professional and personal emails separate.
The Netherlands is a good jurisdiction for privacy and StartMail aims to keep as little data as possible to run their operations. Unlike most secure email providers, StartMail handles encryption server-side, rather than in the browser – see their white paper explaining why.
StartMail allows users to utilize PGP encryption with emails also being encrypted at rest on their Dutch servers. The whole service is user friendly, and you can encrypt and sign your mail with just one click. Another cool feature is that you can create temporary, disposable email aliases "on the fly" to use with different services. IMAP and SMTP are also supported if you want to use StartMail with third-party apps such as Thunderbird.
The downside to StartMail is the lack of dedicated mobile applications, which may be a dealbreaker for some users. This means that if you rely heavily on your smartphone or tablet for email communication, you might find StartMail less convenient to use.
Despite this, StartMail features make it a great option if you're looking for a secure email provider that offers robust encryption and the convenience of managing multiple email identities.
Pros
- Create unlimited email aliases
- PGP end-to-end encryption
- Easy contacts and email migration
- Organize your inbox with filters
- Minimalistic design
- No ads. No tracking. No spam.
- Flexible spam filter
- Unlimited burner aliases
- Anonymous cryptocurrency payments
- Use custom domain
- Compliant with GDPR
Cons
- Short trial period
- Free version unavailable
- Lacks Calendar, Notes, and File storage
3. Mailfence – Fully-featured secure email in Belgium
| Mailfence.com | |
|---|---|
| Based in | Belgium |
| Storage | 5-50 GB |
| Free Tier | Up to 500 MB |
| Price | Free – $3.50/mo |
| Website | Mailfence.com |
Mailfence is a fully-featured secure email provider offering calendar, contacts, file storage, and PGP encryption. It is based in Belgium, which is a solid privacy jurisdiction with strict data protection laws.
The core of Mailfence's security is its powerful end-to-end encryption and digital signatures using OpenPGP (Open Pretty Good Privacy), a non-proprietary protocol for encrypting email using public key cryptography. It is based on the original PGP. This means that only you and the person you're communicating with can read what is sent, and nobody else, not even Mailfence, can access your content. This is a crucial feature for anyone who values their privacy and wants to ensure their communications remain confidential.
The Belgian Data Protection Authority (DPA) is one of the most stringent in the European Union, which is known for its robust data protection framework. This geographical advantage provides an additional layer of security to Mailfence users. It's like having a virtual safe for your emails, providing you with the peace of mind that your data is safe and secure.
Mailfence offers a minimalistic UI.
While many secure email services sacrifice features and functionality for security, you can have it all with Mailfence. This makes Mailfence a good alternative to full email and productivity suites such as G Suite or Office 365.
While Mailfence does log IP addresses and some other data, it provides a user-friendly interface and accepts cryptocurrency payments for added privacy. The logging of IP addresses and some other data is part of Mailfence's commitment to transparency. However, this information is only kept for a short period and is primarily used to maintain the quality and safety of the service.
When I did an in-depth test for the Mailfence review, I found it to be very intuitive, sporting a slick interface with tons of features. Performance was smooth and I didn't encounter any bugs. But, in case you experience any problems, you can always turn to their responsive email and phone support. Note: Due to financial requirements imposed by Google, Mailfence has dropped support for POP/IMAP connections to Gmail servers.
Pros
- Offers end-to-end encryption and digital signatures
- Mobile and web apps
- Data is stored on Belgian servers
- Offers OpenPGP encryption
- Messages, Documents, Calendar, Contacts, and Groups
- SMTP, POP, and IMAP support
- Can synchronize with other email clients
- Supports password-protected messages with expiration time
- Removes IP addresses from mail headers
- OpenPGP user keystore
- Great user interface (recently updated)
- Cryptocurrency payment options
Cons
- Logging of IP address and some other data
- Code is not open source
4. Tuta – Private and secure email in Germany
| Tuta | |
|---|---|
| Based in | Germany |
| Storage | 1 – 1,000 GB |
| Free Tier | Up to 1 GB |
| Price | Free – €3.00/mo |
| Website | Tuta.com |
Tuta is a German secure email service run by a small team of privacy enthusiasts, with no outside investors or owners. Although it is not as well known as Proton Mail, Tuta is a serious player among secure email providers. Its hybrid encryption system overcomes some of the drawbacks of PGP, and your privacy rights are protected by the GDPR and other pro-privacy EU regulations.
Tuta claims that their encryption can be updated/strengthened if necessary against quantum-computer attacks. Here's the latest on quantum encryption from Tuta.
All messages in your inbox, contacts, and calendar are encrypted at rest on servers in Germany. For sending encrypted emails with Tuta, you have two options:
- When emailing another Tuta user, all of your emails are automatically encrypted (asymmetric encryption).
- When sending an email to someone with another email provider, the user receives a link to the message and a password key for encryption/decryption purposes (symmetric encryption).
Tuta establishes an external mailbox for that particular contact, where all the exchanged messages are securely encrypted. This proves to be quite useful, especially if you are using it for business.
While Tuta uses high-end encryption and is arguably one of the most secure email providers anywhere, there are also some downsides. This includes no support for PGP, IMAP, POP, or SMTP. Additionally, you cannot import existing emails into your encrypted Tuta inbox.
To make up for the lack of IMAP support, Tuta has built open-source desktop clients for Windows, Linux, and macOS. They also offer an offline mode, so you can open your emails, calendars, and contacts even when not having access to the web.
All in all, Tuta is a transparent, high-security email provider that just may take your privacy to a whole other level.
Pros
- Encrypted messages (including Subject lines) Address Book, Inbox Rules and Filters, Search Index, encrypted at rest and stored on German servers
- Can search body of encrypted messages
- Can send encrypted messages to non-users
- Strips IP address from emails
- Desktop, mobile, and web apps
- Open source code (including mobile apps)
- Encrypted calendar with iCard support
- Encrypted contacts
- Inbox rules with Spam filter
- Multiple email addresses (aliases)
- Support for custom domains
Cons
- Does not work with PGP
- Currently no way to import existing emails
- Will not work with 3rd-party email clients
5. Mailbox.org – Affordable private German email service
| Mailbox.org | |
|---|---|
| Based in | Germany |
| Storage | 2 – 100 GB |
| Free Tier | 30-day trial |
| Price | €1/mo |
| Website | Mailbox.org |
Mailbox.org is a German secure email service that you should definitely consider. It provides robust security for your email, but it also functions as an all-inclusive productivity suite, similar to Microsoft 365.
It offers a huge lineup of features, including Mail, Calendar, Address Book, Drive (cloud storage), Tasks, Portal, Text, Spreadsheet, Presentation, and Webchat. Impressively, Mailbox.org still has a user-friendly interface and sharp design.
Mailbox.org does receive requests for information from "public authorities." In 2022, they received 55 requests for information, and ultimately rejected about 13% of them. They responded to the rest of them as required by law.
When choosing a secure email provider, you often have to pick between features and security. With Mailbox.org, you can arguably get the best of both worlds. From the security and encryption side, it offers full PGP support and can easily encrypt all your data at rest on their secure servers in Germany. You can also use Mailbox.org with mobile apps and third-party email clients.
Mailbox.org is also affordable, with basic plans starting at only €1 per month. You can pick up a free 30-day trial if you want to test-drive this privacy-focused email provider.
Pros
- PGP support (server-side or E2E through Mailvelope app)
- Company and servers located in Germany with strong privacy protections
- HSTS and PFS for messages in transit
- Protected against man-in-the-middle attacks
- Message and spam filters
- Virus protection
- Full text search
- POP, IMAP, SMTP, ActiveSync support
- vCard, CardDAV, CalDav support
- Messages are encrypted at rest
- Supports custom domains
- Mobile apps for some of the Office features
- Open source
Cons
- No mobile email clients (but can be used with third-party email clients)
- Some tracking during registration
- PGP encryption leaves message subject and metadata exposed
6. Posteo – Privacy-focused email in Germany
| Posteo.de | |
|---|---|
| Based in | Germany |
| Storage | 2 – 20 GB |
| Free Tier | None |
| Price | €1/mo |
| Website | Posteo.de |
Posteo is yet another German email service. It provides strong privacy and security to its users, and in many ways is similar to Mailbox.org. Both are comprehensive email providers that employ PGP encryption. They even charge similar prices. However, Posteo distinguishes itself in a few significant aspects:
- It does not support custom domains
- There is no designated spam folder (emails are either sent to the inbox or not accepted)
- There are no trial or free versions, which is offset by its reasonable pricing
Posteo really makes an effort to protect the privacy of its users. IP addresses are automatically stripped from emails, no logs are kept, and they offer strong encryption standards. In short, this email service takes security and privacy very seriously.
Posteo also supports anonymous registration and anonymous payments – even allowing you to send cash in the mail for no digital trail. This is a trend we've seen with some VPN services as well. And if you pay with a credit card, PayPal, or some other digital method, they manually separate account details from payment info. In short, Posteo is an affordable, customizable, and secure service that's a good option for users on a budget.
Pros
- Mail, Calendar, Contacts, and Notes are encrypted at rest with OpenPGP on secure servers in Germany
- Configurable spam filter
- Migration service for moving from another email service to Posteo
- Subject, headers, body, metadata, and attachments are encrypted
- Includes Messages, Calendar, Contacts (Address Book), and Notes
- Completely Open Source
- Strong commitment to privacy, sustainable energy, and other social initiatives
- Self-financed; good track record (operating since 2009)
- No logs, IP address stripping, secure email storage with daily backups
- Allows anonymous (cash) payments
- Supports SMTP, POP, and IMAP protocols
Cons
- Custom domains not supported; no ".com" options available
- No spam folder (spam emails are either rejected or delivered to regular inbox)
- No trial or free version
- Cryptocurrency payments not supported
7. Runbox – Private and sustainable email in Norway
| Runbox.com | |
|---|---|
| Based in | Norway |
| Storage | 2 – 50 GB |
| Free Tier | 30 day trial |
| Price | $1.66/mo |
| Website | Runbox.com |
Runbox is a Norwegian company that has been in the email business for over 20 years. Norway is a good secure-email jurisdiction, with a strong legal framework for privacy. All Runbox servers are located in secure data centers, running on clean, renewable, hydropower energy.
One unique feature of Runbox is that it gives you 100 aliases to use with your account. Secure file storage is also included, with different pricing tiers. Runbox fully supports SMTP, POP, and IMAP protocols and can be used with third-party email clients. They released Runbox 7 over a year ago and are improving it all the time. So far, this is only a webmail service, so you won't find any mobile or desktop clients.
Unlike some other secure email services, Runbox doesn't have a built-in option for encrypting your entire mailbox. And while you can use PGP with Runbox, it is not yet fully integrated into the platform. Another drawback is that Runbox does not offer a built-in calendar, but this feature may be included later.
Runbox offers a 30-day free trial and makes importing your existing emails simple with the guides on their site. They also go the extra mile by giving you a 60-day money-back guarantee, so you can really get a sense of whether this service suits you before getting locked into a subscription.
Pros
- IP addresses stripped from messages
- Includes Webmail, Contacts, and Files
- Servers run on renewable energy
- Supports SMTP, POP, and IMAP protocols
- Synchronizes with other email clients
- GDPR compliant
- Norway has strong data protection laws
- 100 email aliases per mailbox
- Custom domain names on some paid accounts
- Numerous payment methods accepted (including cash and cryptocurrencies)
Cons
- Browser-based; no desktop or mobile apps
- Not open source
- Data not encrypted within the Runbox system or at rest
- No business-specific features
8. CounterMail – Private and secure Swedish email service
| CounterMail.com | |
|---|---|
| Based in | Sweden |
| Storage | 4 GB+ |
| Free Tier | 7-day trial |
| Price | $4.83/mo |
| Website | CounterMail.com |
CounterMail, a secure email provider based in Sweden, has been operating for over 15 years with a goal to "offer the most secure online email service on the Internet, with excellent free support."
Before we go any further, you should know that registering for CounterMail currently requires an invitation from a premium CounterMail user. If you don't know someone who already uses this service, you are not welcome right now.
CounterMail uses OpenPGP encryption with 4,096-bit encryption keys. They protect their users from identity leaks and Man-In-The-Middle attacks with RSA and AES-CBC encryption on top of SSL. Unfortunately, they do not have their own mobile or desktop apps.
In order to ensure your privacy, they keep no logs and they store your mail on diskless servers. Countermail anonymizes email headers and also strips the sender's IP address. All emails and attachments are stored encrypted at rest using OpenPGP on servers in Sweden. Although the base storage is relatively small (4GB), you can permanently upgrade this via one-time payment.
While CounterMail is a bit more expensive than some other secure email providers, they explain this price difference comes from using only high-quality servers and implementing strong security measures. It may not have all the frills, but CounterMail is a serious security-focused email provider with a 15+ year track record.
Pros
- Supports cryptocurrency payments
- Secure, built-in password manager
- All emails and attachments stored encrypted on no-logs, secure servers in Sweden
- Custom domain support
- Message filter and autoresponder features
- Uses RSA, AES-CBC, and SSL encryption to protect against leaks and MITM attacks
Cons
- Design and UI feels outdated
- More expensive than other secure email options
- Now requires an invite to register
9. Kolab Now – Fully-featured Swiss email
| KolabNow.com | |
|---|---|
| Based in | Switzerland |
| Storage | 5 GB+ |
| Free Tier | 30-day trial |
| Price | $5.89/mo |
| Website | KolabNow.com |
Kolab Now is a private email service based in Switzerland offering lots of features and full email suite functionality. A Kolab Now subscription includes email, contacts, calendars, scheduling, collaboration/sharing tools, and cloud file storage. Right now they are also running a public beta of their voice and video conferencing system. All of these features make Kolab Now an excellent choice for business users, teams, and privacy-focused individuals.
The service offers a stylish and intuitive interface that makes it easy to organize yourself. There's also strong cross-platform support, so you can use Kolab Now on your computers, tablets, and smartphones. It can work in tandem with other email services, like Apple Mail, Outlook, and Thunderbird.
While Kolab Now does offer numerous features and support for all major operating systems and devices, it does not provide the highest levels of security. End-to-end encryption for emails is available via Perfect Forward Secrecy and they are stored encrypted at rest.
The price is also on the higher end, especially if you want access to all features and unlock more storage. However, for those wanting a feature-rich email suite hosted in Switzerland, Kolab Now may be a good fit.
Pros
- Accepts cryptocurrency payments
- Full support for POP, SMTP, and IMAP
- Switzerland jurisdiction with strong privacy protection
- Full email suite with numerous features to replace Gmail, Office365, etc.
- Support for custom domains, teams, and business users
- End-to-end (E2E) encryption is available, but not built in
Cons
- Email not encrypted at rest (but stored in high-security Swiss data center)
- Expensive
10. Soverin – Basic private email in the Netherlands
| Soverin | |
|---|---|
| Based in | The Netherlands |
| Storage | 25 GB |
| Free Tier | No |
| Price | €3.25/mo |
| Website | Soverin.net |
Focusing on user privacy and data protection, Soverin offers a straightforward private email service. With end-to-end encryption and a user-friendly interface, Soverin is an excellent choice for users who want a simple and secure email service.
While Soverin may not offer numerous advanced features compared to some competitors, its focus on privacy and simplicity make it a top choice for users seeking a basic private email service. This means that while you might not get all the bells and whistles that come with some other email services, you get a no-nonsense, secure platform that prioritizes your privacy and makes email management a breeze. For those who value simplicity and security over a plethora of features, Soverin is a solid choice.
Pros
- 25 GB of data storage for all plans
- Data protected under Dutch privacy laws and GDPR
- Can be used with third-party email clients
Cons
- No custom mobile apps
- Not open source
- No built-in encryption options
Bonus track: Skiff Mail
Skiff Mail is a young email service based in San Francisco, California. It provides PKI end-to-end-encryption that doesn't rely on using public/private keys or passphrases for access. If anything, this makes it more convenient for casual users to protect their data.
Skiff Mail offers plenty of space to store files and messages (15GB+). Speaking of which, you can easily import old messages via .EML file for convenient data migration. You will get aliases at your disposal, along with option to create custom/Skiff domains. Skiff also offers Drive (file storage), Calendar, and Pages (doc editor). So, it is equally suitable for private and business users.
With prices starting at $3/month, Skiff Mail is an affordable secure email alternative. There's also a free version, so you can thoroughly test it before deciding to subscribe. Additionally, it provides features such as scheduled sending of messages, automatic replies, custom signatures, and the capability to unsend mail, enhancing the functionality and convenience of your email management.
While Skiff Mail is based in the US, which may raise privacy concerns for some users due to the country's surveillance laws, but strong encryption features and user-friendly interface make it a solid option for those seeking a secure email service.
Email jurisdiction and data privacy
Did you know that the jurisdiction in which your email service is located can seriously impact the security of your data? Depending on your threat model, this could be a major consideration. For an in-depth overview of jurisdiction and privacy, you may want to read our article on the 5 Eyes, 9 Eyes, 14 Eyes surveillance alliances.
Surveillance in the United States (leading member of the Five Eyes)
Tech companies in the US can be forced to give government agencies direct access to their servers for "extensive, in-depth surveillance on live communications and stored information" – as explained in the PRISM surveillance program. Data requests can also be accompanied by gag orders, which forbid the company from disclosing what's going on (see also National Security Letters).
Several instances have been reported where American email service providers were compelled to surrender information. In a notable case, Lavabit chose to shut down the business instead of disclosing user data. Riseup, another email service provider in the US, was forced to hand over data to law enforcement agencies.
State of privacy in Europe
Politicians in Europe are frequently trying to find an excuse to limit or ban the use of encryption by their people. This time, the argument is that encryption must be banned to fight child abuse. Once again it is up to email services like Tuta and Mailfence to protect the privacy rights of their users. In April 2023, a group of tech companies sent an open letter to the European Parliament arguing against the mass surveillance that the elimination of encryption would be meant to enable.
How this will turn out is unclear, but the possibility of the EU banning encryption casts doubts on the viability of any secure email service based in the EU.
All email providers must comply with the law
While these examples may seem alarming, the truth is that all email providers must comply with legal requirements in the country they are operating in. For example, Proton Mail, based in Switzerland, has also been forced to log IP addresses and disable accounts by valid court orders, as disclosed in their transparency report.
All in all, some jurisdictions are much better than others, so choose wisely. As a general rule, we'd avoid email services in the US and other Five Eyes jurisdictions.
Want secure email? Pay for it.
The unlimited "free" email business model is fundamentally flawed. It offers a free service, which is used to collect data and thereby monetize the user and make money on ads. In contrast, here we recommend privacy-friendly, secure, ad-free email services. While some of these email services offer limited free subscriptions, you will need to upgrade to a paid plan for more storage and premium features.
Secure email shortcomings and PGP flaws
Most secure email services mentioned in this guide use PGP for end-to-end encryption. PGP, which stands for Pretty Good Privacy was invented back in 1991 by Phil Zimmermann.
PGP Flaws – While PGP is considered a trustworthy, secure encryption method, there have been some flaws in implementing PGP that have made headlines. While the news did attract lots of attention, the "flaws" were mainly tied to the incorrect implementation of PGP by third parties. To our knowledge, this did not affect the secure email providers mentioned in this guide.
Limited Use – Another fundamental problem with adopting secure email is that few people are willing to go through the hassle of PGP key management, encryption, decryption, etc. However, there are some solutions to this, and by some measures encrypted email usage continues to grow.
Many providers address this issue by making encryption automatic and seamless. Tuta, for example, uses built-in AES encryption that automatically encrypts emails between Tuta users, including headers, subject line, body, and attachments.
Vulnerabilities – Even when using a secure browser, there are still weak points to consider with using browser-based email clients. Phil Zimmermann gave an interview highlighting some of these shortcomings:
"The browser is not a terribly safe place to run code. Browsers have a large attack surface," he said. Wherever encryption and decryption take place, though, it's a vast improvement on no encryption. But even encrypting messages may not be enough, depending on the threat model. The very nature of email makes it vulnerable.
"Email has an enormous attack surface," Zimmermann said. "You've not only got cryptographic issues but you've got things like spam and phishing and loading images from a server somewhere that might have things embedded inside."
On a positive note, there are many options for securing your browser. Furthermore, most secure email providers offer protection against these attack vectors by blocking email images by default and utilizing virus filters.
However, you should keep in mind that desktop email clients can also be problematic. They can potentially reveal unique information about your operating system, your IP address, and location. Regardless of these limitations, using a secure email provider will help you keep large tech companies from extracting your email data for third parties.
Secure email vs secure messaging apps
Depending on your threat model, you may also want to consider using secure messaging apps, which do not have all of the vulnerabilities discussed above. Encrypted messaging apps generally offer a higher level of security than email services. Plus, they are much easier to use than PGP email encryption.
Encrypted messaging apps are also convenient for back-and-forth conversations, document sharing, and collaboration with others.
Use a VPN with email
One fundamental problem with email is that it can expose your IP address and location to third parties, by design. While some secure email services strip IP addresses and conceal metadata, many others do not. And as we saw with the Proton Mail logging case, email services may be forced to log user IP addresses by valid court orders, without disclosing any information to the user. We've seen this with email providers in the US, Germany, and even Switzerland.
Finally, there's also the fact that many email services keep logs for security. This may include user IP addresses, connection times, and other metadata. Of course, whenever you have logs, there's a risk that this data could end up with third parties, for various reasons.
To effectively conceal your IP address and location, you will need to use a good VPN (Virtual Private Network). A VPN creates a secure tunnel between your device and a VPN server, encrypting your traffic and concealing your real IP address and location. This will improve your privacy and security, all the while you carry on with business as usual.
Popular and generally recommended VPN services include NordVPN, ExpressVPN, Proton VPN, Surfshark, among others.
Benefits of open source in secure email providers
When considering secure email providers, open-source software offers numerous benefits. Allowing users and developers to access and review the source code ensures transparency, enabling verification of the software's security and trustworthiness. Such public scrutiny helps identify potential security vulnerabilities, ensuring the software is regularly updated and improved.
Another advantage of open-source software is its community-driven development. This collaborative approach allows a community of developers to work together, leading to faster development and more reliable, secure software. Potential issues are identified and resolved more swiftly.
In summary, choosing a secure email provider that utilizes open-source software is beneficial for security and reliability. It allows public review and verification of encryption protocols and privacy protections. Regardless of your circumstances, switching to a secure, private email service will enhance your privacy. Major email providers like Gmail, Yahoo, and Microsoft don't always prioritize user privacy, so you have to look after it yourself. Paying for one of these secure email services means you won't be paying with your privacy by using "freebies".
Switching to one of these email services will significantly bolster the security of your private communications. The key is to also stay vigilant against non-technical attacks, such as classic email scams that never seem to go away.