The 3 most secure and encrypted email providers

ProtonMail

Price: Free. Premium accounts available.
Storage: 500MB as standard. Up to 20GB for Premium accounts.
Country: Switzerland

ProtonMail started in 2013 from some very impressive beginnings. Originally developed by researchers in CERN, a successful crowdfunding campaign saw the open source, encrypted email provider exit beta in March 2016. ProtonMail uses end-to-end encryption so that messages are encrypted at your end, and can not be unencrypted by the company — or anyone else for that matter.

As ProtonMail predominantly provides free accounts, it is reasonable to consider how they will sustain the service. In a comment posted to Reddit, ProtonMail made it clear that they have a Defence Fund which would sustain the service for up to a year without any other revenue.

Why ProtonMail?

All data is stored on the company’s servers in Switzerland — a country well known for its tough stance on privacy and data protection. Importantly ProtonMail is open source. This is a huge plus for privacy and security advocates. Closed or proprietary software methods cannot be tested or validated by anyone, meaning that you have to place your trust in the company. Open source means that, should you want to, you can verify the security of the platform yourself.

Although emails to and from other ProtonMail users are end-to-end encrypted, if you communicate with unencrypted services like Gmail, ProtonMail will scan these emails to protect against spam. However, theses messages are scanned in memory, meaning that they aren’t kept and will be overwritten in very little time. As soon as the email has been scanned it is then encrypted.

According to their Privacy Policy, IP logging is disabled by default, although options exist to turn this on if you wish. This is a benefit to your privacy because it protects your location, and prevents linking of data using your IP address. ProtonMail also doesn’t store any of your data once it’s deleted. If you delete an email — it’s really gone. The only exception is when the data has been stored in a backup, in which case it may take up to 14 days to be fully removed.

ProtonMail also doesn’t require any personal information in order to sign up for the service, although you may add a third-party email address for recovery purposes. If the ephemeral messaging that companies like Snapchat and Telegram have implemented is your thing, then you’ll be pleased to know that ProtonMail has a similar feature for email.

TutaNota

Price: Free. Premium accounts available.
Storage: 1GB as standard. Upgradable.
Country: Germany

Germany’s own Tutao GmbH launched Tutanota in 2011 as a freemium, encrypted webmail service. The name gives clues to their beliefs, coming from the Latin “tuta nota” meaning “secure message”. The service’s servers are also based in Germany, making them subject to Germany’s rigorous Federal Data Protection Act. However, privacy advocates may not be agreeable to their data being stored in Germany, after it emerged that Germany’s Federal Intelligence Service had collaborated with the NSA in their surveillance programs.

Why Tutanota?

However, aside from server location, Tutanota makes a very compelling secure service. In many ways, their feature-set largely mirrors that of ProtonMail. They use end-to-end encryption to ensure that no mail is viewable on their servers. If you email an account that isn’t encrypted like Gmail, then Tutanota sends a link to a temporary account where the recipient can view the encrypted message.

Tutanota is also open source, with the code available on Github for inspection. Currently they do not encrypt the metadata associated with any stored mail, like sender, recipient, and date. However, their FAQ states that they are looking into the possibility of adding this in the future.

Tutanota uses 2048 bit RSA and 128 bit AES encryption methods. However, they do not currently support PGP, although they are hoping to develop an API to allow users to communicate with anyone using PGP encryption. They do collect logs but only for technical information, warning and error messages. It is worth noting that Tutanota says that none of the logs contain personal information, and are only kept for 14 days.

Tutanota is a freemium provider, offering free accounts alongside paid Premium accounts which add functionality. If you opt for a Premium account it is 1€ per month. A Premium account allows you to add up to five aliases, use your own domain, and set inbox rules.

Mailfence

Price: Free. Premium accounts available.
Storage: 200 MB of emails, 250 MB of documents as standard.
Country: Belgium

From the creators of ContactOffice, the virtual office provider, comes Mailfence – an encrypted and free privacy focused webmail client. Following the Snowden revelations in 2013, the founders of ContactOffice believed that there was a need for a secure, privacy minded email platform. As with many other European countries, Belgium has strong privacy laws which favour the consumer rather than the company. Unlike many other countries there is little evidence to suggest that Belgium collaborated in the NSA surveillance schemes.

Why Mailfence?

ContactOffice was started in 1999, so they have experience in growing a service, which should provide some reassurance that they won’t abruptly close down. This experience leads to one of the standout features of Mailfence. It doesn’t only focus on email privacy, but the service also includes calendars, contacts, and document storage. Although they offer Premium accounts, they make most of their money by licensing their email and collaboration software to companies and universities. Sadly, Mailfence is not open source so by using the service you are forced to trust that the claims they make on their website are correct.

Taking a stand for your principles is admirable in itself, but alongside that ContactOffice donates 15% of the income from their Pro plans to the privacy organisations the Electronic Frontier Foundation (EFF) and the European Digital Rights Foundation (EDRi). Belgium’s privacy laws dictate that if a judge issues a court order then Mailfrence must comply. However, any outside authority has no right to impose orders or access data.

Mailfence is end-to-end encrypted and supports OpenPGP. You can generate a key on your computer which is then encrypted using 256 bit AES and stored on Mailfence’s servers. They also support two-factor authentication to prevent unauthorized access to your account.

One of the major downsides to Mailfence is that there is currently no mobile application. Although they have stated app development is a priority for 2017. However, if you want to sync to a mobile device then the only option is to use Microsoft’s Exchange ActiveSync. If you choose to upgrade to a Pro account then you can also use POPS, IMAPS, and SMTPS.

Keep It Secret, Keep It Safe

Many free email providers either do little to protect your privacy, or even take steps to erode it for you. Finding a secure, safe, and encrypted service is a move worth making. You should judge a provider on their encryption methods, how they finance the service, and where the servers are located.

Of course, no online service is entirely secure, no matter the ethics of the provider. There will always be hackers and surveillance agencies looking to build their ever-increasing databases. Of course, if you want to minimize the risk further, you could always run your own email server.