12 Best Private and Secure Email Services

Unless you are using a secure email provider that respects your privacy, the answer is probably no.

Most large email providers, such as Gmail and Yahoo, do not respect the privacy of your inbox. For example,

Another concern is where your email service is located and how this may affect your data and privacy. Some jurisdictions have laws to protect data privacy (Switzerland), while others have laws in place to erode it (United States). We’ll cover this in more detail below.

On a positive note, there is a relatively simple solution for keeping your inbox more secure: switch to a secure email provider that respects your privacy.

What is the best secure email service?

With so many different types of users, there is no single “best secure email” service that will be the top choice for everyone.

While some may prioritize maximum security and strong encryption, others may want convenience and simplicity with user-friendly apps for all devices.

Here are just a few factors to consider when switching to a secure email provider:

• Jurisdiction – Where is the service located and how does this affect user privacy? Where is your data physically stored?
• PGP support – Some secure email providers support PGP, while others do not use PGP due to its vulnerabilities and weaknesses.
• Import feature – Can you import your existing emails and contacts?
• Email apps – Due to encryption, many secure email services cannot be used with third-party email clients, but some also offer dedicated apps.
• Encryption – Are the emails end-to-end encrypted in transit? Are emails and attachments encrypted at rest?
• Features – Some features you may want to consider are contacts, calendars, file storage, inbox search, collaboration tools, and support for DAV services.
• Security – What are the provider’s security standards and policies?
• Privacy – How does the email service protect your privacy? What data is being collected, for how long, and why?
• Threat model – How much privacy and security do you need and which service best fits those needs?

The goal of this guide is to help you find the best secure email solution for your unique needs.

This list is not in rank order. (Choose the best secure email service for you based on your own unique needs!)

Here are the most secure email providers that protect your privacy.

1. Tutanota – Private and secure email in Germany

Tutanota is a Germany-based secure email service run by a small team of privacy enthusiasts, with no outside investors or owners. While their service is focused on providing you with the highest levels of email security, it still remains user-friendly and intuitive.

Rather than using PGP and S/MIME, Tutanota utilizes their own encryption standard incorporating AES and RSA. This standard encrypts the subject line, supports forward secrecy, and can be updated/strengthened if necessary against quantum-computer attacks, as they explain here. All messages in your inbox, contacts, and calendar are encrypted at rest on servers in Germany. For sending encrypted emails with Tutanota, you have two options:

1. Emailing another Tutanota user, which encrypts everything automatically (asymmetric encryption)
2. Emailing an external (non-Tutanota) user with a link to the message and sharing a password key for encrypting/decrypting messages (symmetric encryption).

While Tutanota uses high encryption standards and is arguably the most secure email provider, it also comes with some tradeoffs. This include no support for PGP, IMAP, POP, or SMTP. Additionally, you cannot import existing emails into your encrypted Tutanota inbox, but they’re currently working on adding a migration feature – see the roadmap.

To explain why Tutanota does not rely on PGP standards, Tutanota cofounder Matthias Pfau wrote this piece for Net Todays readers, Let PGP Die: Why We Need a New Standard for Email Encryption.

If you are looking for a transparent, high-security email provider run by a small team privacy enthusiasts, Tutanota is a solid choice.

https://Tutanota.com

2. ProtonMail – Secure email in Switzerland

ProtonMail is a Switzerland-based email service that enjoys a great reputation in the privacy community. It was started by a team of academics working at MIT and CERN in 2014. Shortly thereafter, it was promoted in American media as “the only email system the NSA can’t access” – which was around the time Lavabit was shut down for not cooperating with the US government.

Looking at the service itself, ProtonMail does a lot of things right. It utilizes PGP encryption standards for email and stores all messages and attachments encrypted at rest on Swiss servers. ProtonMail has a unique feature for “self-destructing messages” and they have also added address verification and full PGP support.

Regarding encryption, however, it’s important to note that ProtonMail does not encrypt subject lines of emails, which is an inherent limitation with PGP (not ProtonMail). Additionally, the ProtonMail search function can only search subject lines within your inbox, but not the content of your emails.

ProtonMail does offer some great apps for mobile devices (Android and iOS). You can also use ProtonMail with third-party apps through the ProtonMail Bridge feature (restricted to paid users).

Overall ProtonMail is a well-regarded email provider, and should be a great secure email option for most users. Switzerland remains a strong privacy jurisdiction that is not a member of any surveillance alliances. In addition to email, the same team also offers a VPN service, ProtonVPN.

https://ProtonMail.com/

3. Mailbox.org – Private email in Germany

Another Germany-based secure email provider worth considering is Mailbox.org. Unlike some of the other secure email services in this guide, Mailbox.org is fully-featured and can function as a full email and productivity suite. It offers a huge lineup of features: Mail, Calendar, Address Book, Drive (cloud storage), Tasks, Portal, Text, Spreadsheet, Presentation, and Webchat. The layout and design of Mailbox.org are also user-friendly, even with all the features and preferences.

When choosing a secure email provider, you often have to choose between features and security. With Mailbox.org, you can arguably get the best of both worlds. From the security and encryption side, Mailbox.org offers full PGP support and options to easily encrypt all your data (at rest) on their secure servers in Germany. You can also use Mailbox.org with mobile apps and third-party email clients.

Lastly, Mailbox.org is very affordable, with basic plans starting at only €1 per month and going up for more storage and features. You can pick up a free 30-day trial if you want to test-drive this privacy-focused email provider.

https://Mailbox.org/

4. Posteo – Privacy-focused email in Germany

Posteo is (another) German email provider that offers a high level of privacy and security for its users. In some respects, it has much in common with Mailbox.org. Both are fully-featured email providers that utilize PGP encryption standards, with similar prices. But in a few key areas, Posteo is a bit different:

• Custom domains are not supported.
• There is no spam folder (all emails are either delivered to your inbox or rejected).
• There’s no trial or free tier (but still quite affordable).

In terms of privacy, Posteo really makes an effort to protect the privacy of their users. IP addresses are automatically stripped from emails, no logs are kept, and they offer strong encryption standards. They also support completely anonymous registration and anonymous payments – even allowing you to send cash in the mail for no digital trail. And if you pay with a credit card, PayPal, or some other digital method, they manually separate account details from payment info.

https://Posteo.de/

5. Mailfence – Fully-featured secure email in Belgium

Mailfence is a fully-featured secure email provider offering calendar and contacts functionality, file storage, and PGP encryption support. It is based in Belgium, which is a good privacy jurisdiction with strict data protection laws.

For those wanting full PGP control and interoperability, without plugins or add-ons, Mailfence is a solid choice. Whether you are a personal user or you need a secure email solution for your business or team, Mailfence likely has all the features and options you’d want. Similar to Mailbox.org, Mailfence is a great alternative to full email and productivity suites, such as G Suite or Office 365

In testing everything out for the Mailfence review, I found it to work very well with an intuitive design and slick layout. Mailfence also offers email and phone support, in addition to cryptocurrency payment options.

One of the main drawbacks with Mailfence, which separates it from other secure email providers, is that there’s no built-in way to encrypt your entire inbox. Instead, your only option to do this is locally with a third party client. Fortunately, they are looking to integrate a built-in encryption option sometime in 2020.

https://Mailfence.com

6. Runbox – Private and sustainable email in Norway

Runbox is a long-running private email service in Norway that has been operating for over 20 years. Norway is also a good jurisdiction with strong legal framework for privacy . All Runbox servers are located in secure Norwegian data centers, running on clean, renewable, hydropower energy.

One unique feature of Runbox is that it gives you 100 aliases to use with your account. Secure file storage is also included, with different pricing tiers. Runbox fully supports SMTP, POP, and IMAP protocols and can be used with third-party email clients. Currently they’re working on an updated webmail client (version 7) that should be released soon – but they do not offer custom mobile or desktop clients.

Unlike some other secure email providers, Runbox does not have a built-in option for encrypting your entire mailbox. And while you can use PGP with Runbox, it is not yet built into the platform. Another drawback is that Runbox does not offer a built-in calendar, but this feature may be included in Version 7 (when released).

Runbox offers 30 day free trials and makes importing your existing emails simple with the guides on their site. They are currently offering a discount “2 years for the price of 1” on their website here.

https://Runbox.com

7. CounterMail – Private and secure Swedish email service

Next up on our list is CounterMail, a secure email provider based in Sweden. CounterMail has been operating for over 10 years with a philosophy to “offer the most secure online email service on the Internet, with excellent free support.” CounterMail uses OpenPGPG encryption with 4,096-bit encryption keys along with no-logs, diskless servers to protect user privacy. Countermail anonymizes email headers and also strips the sender’s IP address. All emails and attachments are stored encrypted at rest using OpenPGP on servers in Sweden.

While CounterMail is a bit more expensive than some other secure email providers, they explain this price difference comes from using only high-quality servers and implementing strong security measures. CounterMail also protects users from identity leaks and Man-In-The-Middle attacks with RSA and AES-CBC encryption on top of SSL. It may not have all the frills, but CounterMail is a serious security-focused email provider with a 10+ year track record.

https://CounterMail.com

8. CTemplar – A new, “armored email” service in Iceland

CTemplar is a newer service in Iceland claiming to be the “The most secure & private email service in the world.” As they correctly point out, Iceland has very strong privacy laws, perhaps the best in the world. CTemplar offers some interesting security features, which you can read about here. All emails attachments, and contacts are stored encrypted at rest on bare-metal servers in Iceland.

Although it is relatively new, CTemplar seems to be a strong contender in the secure email space. You can learn how they aim to raise the bar with security standards on their website. CTemplar offers free accounts with up to 1 GB of email storage, but to get access to all features you’ll need a paid plan.

https://CTemplar.com

9. Kolab Now – Fully-featured Swiss email

Based in Switzerland, Kolab Now is a private email service offering lots of features and full email suite functionality. A Kolab Now subscription includes email, contacts, calendar, scheduling, collaboration/sharing tools, and cloud file storage. All of the features and options make Kolab Now an excellent choice for business users, teams, and privacy-focused individuals.

While Kolab now does offer numerous features and support for all major operating systems and devices, it also does not offer as much encryption for those who want the highest levels of security. End-to-end encryption for emails is not built-in and emails are not stored encrypted at rest.

The price is also on the higher end, especially if you want access to all features and more storage. However, for those wanting a feature-rich email suite hosted in Switzerland, Kolab Now may be a good fit.

https://KolabNow.com

10. Startmail – Private email hosted in The Netherlands

StartMail is a secure email service brought to you by the team behind Startpage, a private search engine based in the Netherlands. While there was recently news about System1 investing in Startpage, StartMail is its own unique entity under StartMail B.V. – a company operating under Dutch law in The Netherlands.

The Netherlands is a good jurisdiction for privacy and StartMail aims to keep as little data as possible to run their operations (see privacy policy). Unlike most secure email providers, StartMail handles encryption server-side, rather than in the browser – see their white paper explaining why.

StartMail allows users to utilize PGP encryption with emails also being encrypted at rest on their Dutch servers. One cool feature with StartMail is they give you the ability to create temporary, disposable email addresses “on the fly” to use with different services. IMAP and SMTP are also supported if you want to use StartMail with third-party apps such as Thunderbird.

https://www.StartMail.com

11. Soverin – Basic private email in Netherlands

Soverin provides a basic and private email service at a reasonable price. Plans come with 25 GB of storage and custom domains are supported. All data is stored on Soverin servers in The Netherlands. Soverin strips IP addresses from headers while also using strong encryption standards, although email is not stored encrypted at rest.

For those wanting a basic private email with lots of storage that is protected by European privacy laws, Soverin may be a good choice. It can also be used with third-party email clients and importing old emails is relatively simple.

https://Soverin.net

12. Thexyz – A fully-featured private email service in Canada

Another privacy-focused email service worth noting is Thexyz. It is a secure email and web hosting business based in Canada that offers solutions for businesses and private users. The email arm of Thexyz has been operating since 2009, as explained on the about page. While Canada may not be the best jurisdiction for privacy (Five Eyes), this may not be too concerning depending on your needs and threat model.

Thexyz does offer some great privacy and security features. Accounts come with encrypted cloud storage as well as contacts, calendar, and team collaboration tools. All emails are stored encrypted at rest using AES 256-bit encryption, with double geo-location redundancy. With a basic account, you get unlimited aliases and 25 GB of storage (upgradable to 100 GB). Even with all the perks and features, Thexyz is still very affordable at $2.49/mo with the premium webmail plan.

https://www.thexyz.com

Email jurisdiction and data privacy

Where your email service is located (jurisdiction) can seriously impact the security of your data. Depending on your threat model, this could be a major consideration. For an overview on jurisdiction and privacy, you may want to read my article on the Five/9/14 Eyes surveillance alliances.

Here are some reasons to pay attention to jurisdiction.

United States (leading member of the Five Eyes)

Tech companies in the US can be forced to give government agencies direct access to their servers for “extensive, in-depth surveillance on live communications and stored information” – as explained in the PRISM surveillance program. Data requests can also be accompanied by gag orders, which forbids the company from disclosing what’s going on (see also National Security Letters).

There are a few known cases of US email providers being forced to give up data. In one prominent example, Lavabit decided to shut down the business rather than give up user data. Another US email provider, Riseup, was also forced to give up data to authorities.

After exhausting our legal options, Riseup recently chose to comply with two sealed warrants from the FBI, rather than facing contempt of court (which would have resulted in jail time for Riseup birds and/or termination of the Riseup organization).

There was a “gag order” that prevented us from disclosing even the existence of these warrants until now. This was also the reason why we could not update our “Canary” [warrant canary that warns users about these events].

Germany (member of the 14 Eyes)

While Germany has long been a rock-solid jurisdiction for privacy-focused tech companies, I’ve noticed some troubling trends recently:

1. In January 2019, a German court ruled that Posteo must log IP addresses if required by a valid court order. Posteo explained they would not change their system to log all users’ IP addresses, but would comply for specific users, if ordered by a German court.
2. In November 2019, a German court ruling forced Tutanota to provide real-time access to unencrypted emails for specific users targeted by a court order. As Tutanota explained, only unencrypted messages sent after the court order was received would be affected.

All email providers must comply with the law

While some of these cases may seem alarming, the truth is that all email providers must comply with legal requirements in the country they are operating in. For example, ProtonMail, a Switzerland email provider, has also been forced to log IP addresses and disable accounts by valid court orders, as they disclose in their transparency report.

(Note: If you are concerned about your email service logging your IP address, then simply use a good VPN service.)

Considering everything, some jurisdictions are much better than others, so choose wisely. As a general rule, I’d still avoid email services in the US, and perhaps other Five Eyes jurisdictions.

Want secure email? Pay for it.

The unlimited “free” email business model is fundamentally flawed. It offers a free service, which is used to collect data and thereby monetize the user and make money on ads. With these privacy-abusing “free” services, you are actually paying for the product with your data.

In contrast, here we recommend privacy-friendly, secure, ad-free email services. While some of these private email services offer limited free subscriptions, you will need to upgrade to a paid plan for more storage and premium features (the freemium business model).

Support good privacy businesses

Fortunately, you can “vote with your dollars” by supporting these privacy-respecting businesses and upgrade to paid accounts. This will help secure email providers to grow, improve, and serve more people with an ethical business model that does not rely on exploiting their users’ data.

Secure email shortcomings and PGP flaws

Most secure email solutions mentioned in this guide utilize PGP for end-to-end encrypted email. PGP, which stands for Pretty Good Privacy and was invented back in 1991 by Phil Zimmermann.

PGP flaws – While PGP is considered a trustworthy, secure encryption method, there have been some flaws in implementing PGP that have made headlines recently – see also the EFAIL vulnerabilities. While the news did attract lots of attention, the “flaws” were mainly limited to the incorrect implementation of PGP by third parties. To my knowledge, this did not affect the secure email providers mentioned in this guide.

Limited Use – Another fundamental problem with adopting secure email is that few people are willing to go through the hassle of PGP key management, encryption, decryption, etc. There are some solutions, to this, however, and by some measures encrypted email usage continues to grow.

Many providers address this issue by making encryption automatic and seamless. Tutanota, for example, uses built-in AES encryption that automatically encrypts emails between Tutanota users, including headers, subject line, body, and attachments. They also provide a secure, two-way communication contact form called Secure Connect.

Vulnerabilities – Even when using a secure browser, there are still vulnerabilities to consider with browser-based email clients. Phil Zimmermann gave an interview highlighting some of these shortcomings:

“The browser is not a terribly safe place to run code. Browsers have a large attack surface,” he said.

Wherever encryption and decryption take place, though, it’s a vast improvement on no encryption. But even encrypting messages may not be enough, depending on the threat model. The very nature of email makes it vulnerable.

“Email has an enormous attack surface,” Zimmermann said. “You’ve not only got cryptographic issues but you’ve got things like spam and phishing and loading images from a server somewhere that might have things embedded inside.”

On a positive note, however, there are many options for securing and hardening your browser – see the secure browser and Firefox privacy guides. Furthermore, most secure email providers offer protection against these attack vectors by blocking email images by default while also utilizing virus filters.

Keep in mind, however, that non-browser email clients can also be problematic – potentially revealing unique information about your operating system (user agent) as well as your IP address and location.

Regardless of these limitations, using a secure email provider will help keep large tech companies from harvesting your email data for third parties.

Secure email vs secure messaging apps

Depending on your threat model, you may also want to consider using secure messaging apps, which do not have all of the vulnerabilities discussed above with email. One of my favorites is Wire, which is free for personal use. Here are three secure messaging apps worth considering:

1. Wire
2. Signal
3. Keybase

Encrypted messaging apps generally offer a higher level of security over email, plus they are much easier to use than PGP email encryption.

Finally, encrypted messaging apps are also convenient for back-and-forth conversations, document sharing, and collaboration with others. For more information, check out the Secure Messaging section on the homepage.

Always use a good VPN with email

One fundamental problem with email is that it can expose your IP address and location to third parties, by design.

While some secure email services strip IP addresses and conceal metadata, many others do not. Even the popular Enigmail encryption plugin, which is used with Thunderbird, was found to be leaking user IP addresses. Some email services may be forced to log user IP addresses by valid court orders, without disclosing any information to the user.

There have also been many cases where email services are compelled to log user IP addresses by court orders. We’ve seen this with email providers in the US, Germany, and even Switzerland.

Finally, there’s also the fact that many email servers keep logs for security, which may include user IP addresses, connections times, etc. Of course, whenever you have logs, this data could end up with third parties (for various reasons).

To effectively conceal your IP address and location, you can simply use a good VPN service. (See the ‘What is a VPN‘ guide for more a detailed overview.)

A VPN creates a secure tunnel between your device and a VPN server, encrypting your traffic and concealing your real IP address and location. The VPN will encrypt and anonymize your internet traffic, while you carry on with business as usual. Some of the larger providers, such as ExpressVPN and NordVPN, offer apps for all major devices and large server networks around the world.

Due to the security and privacy benefits a VPN offers, it’s a smart idea to use one whenever you’re online. Internet providers in many countries are recording user browsing history (via DNS requests), which may be passed off to advertisers or government agencies (mandatory data retention laws). With a VPN, your DNS requests are encrypted and handled by the VPN server and unreadable to your ISP or other parties.

For more info, see the best VPN services.

Conclusion on secure and private email

Whatever your situation is, using a secure and private email provider is a smart step to protect your data. Gmail, Yahoo, Microsoft, and the other big email players do not place the highest priority on your privacy. Paying for a good email service that values privacy ensures you aren’t paying with your personal data.

As a brief recap, below is a table highlighting the best secure and private email providers. If you have a specific question about one of these services, you may want to reach out to them directly through their website.

See the main privacy tools guide for other privacy and security essentials.

Email Service

Storage

Price/mo.

Website

Final Disclaimer and Instructions from NetTodays

NetTodays is a platform for Best VPN Review and Which VPN Service is Best for you.  How to get Best Free VPN Review without the expense. NetTodays suggest how to utilize the most recent VPN and reviews about What is the Best VPN for Netflix. Best VPN built for speed, you can select a server at the country or city level and can favorite a location for future use. NetTodays help you to understand that What is the Best VPN on the Market. NetTodays provide you all these reviews and recondition about Best VPNs for Gaming

A VPN is a service that both encrypts your data and hides your IP address by bouncing your network activity through a secure chain to another server miles away. This obscures your online identity, even on public Wi-Fi networks, so you can browse the internet safely, securely, and anonymously.

NetTodays gives you answers to all questions which are in your mind about VPN.

NetTodays also suggest continually utilizing Best VPN when you are using a newer Wi-Fi Network. Here is a decent dependable guideline: If you’re away from the workplace or home, and you’re utilizing another person’s Wi-Fi (even that of a relative or a companion, since you can’t be sure whether they’ve been compromised), utilize a VPN. It’s especially significant in case you’re getting to help that has specifically distinguishing data. Keep in mind, a great deal goes on in the background, and you never truly know whether at least one of your applications is verifying behind the scenes and putting your data in danger.

Have you used one of these secure email providers? Feel free to leave your feedback/review of the service below.

Last updated September 16, 2021.