Tutanota Review and Hands-On Testing: Most Secure Email?

Tutanota is a secure email service run by a small team of privacy enthusiasts in Germany. Although it may not be widely known, Tutanota is a serious player among secure email providers. It uses a hybrid encryption system instead of PGP, and is protected by the GDPR and other pro-privacy EU regulations.

In this Tutanota review, we’ll be posting hands-on test results while sharing our research findings and personal experience in using this email provider for the past few years.

The Tutanota team has a strong vision for their product:

In the future Tutanota will be the privacy-respecting alternative for Google with a calendar, notes, cloud storage – everything encrypted by default!

That being the case, we’re really going to put Tutanota through the wringer to see if they deserve your hard-earned money and attention. Let’s take a look!

https://tutanota.com

Tutanota features overview

Tutanota uses industry-standard end-to-end encryption algorithms for email and other user data. All data is encrypted at rest and only decrypted in your browser or email client. Because it does not use PGP encryption, Tutanota also encrypts the subject line of messages, which improves your privacy relative to ProtonMail.

Additional interesting features of Tutanota include:

• Anonymous signup process doesn’t require you to give them a phone number or other personally identifiable information.
• Open source code, including apps.
• Desktop clients for Windows, Mac OS, and Linux (beta).
• Android and iOS mobile apps, with Google-free access to Android App through F-Droid.
• Premium accounts with a range of additional benefits, including a brandable Business account.
• The ability to send encrypted emails to non-Tutanota users.
• Whitelabel and Secure Connect support in paid plans for additional fee.
• Dark and Light themes.

Tutanota launched in 2011 (not long before Edward Snowden began leaking information), and is based in Hanover, Germany.

According to their website:

With its unique open source technology Tutanota fights for privacy and freedom of speech online, allowing everybody including NGOs, journalists and activists to send encrypted emails on desktop and mobile. In addition, Tutanota’s affordable business version enables companies and organisations of all sizes to easily secure their email communication.

Germany has strong privacy laws, including the Bundesdatenschutzgesetz and GDPR. That said, as elsewhere in the West there is political pressure to reduce personal privacy rights to “counter terrorism”.

In addition, Germany is a member of the 14 Eyes intelligence alliance. This isn’t ideal, but Tutanota provides a detailed explanation of the laws that apply to them and the data they may be forced by law to disclose.

Tutanota technical specifications

Tutanota uses a couple of different encryption algorithms to ensure that your messages cannot be read or tampered with:

Tutanota uses symmetric (AES 128) and asymmetric encryption (AES 128 / RSA 2048) to encrypt emails end-to-end. When both parties use Tutanota, all emails are automatically end-to-end encrypted (asymmetric encryption). For an encrypted email to an external recipient, a password for encrypting & decrypting the email (symmetric encryption) must be exchanged once.

On top of its automatic end-to-end encryption, Tutanota uses STARTTLS with an extended validation certificate, Perfect Forward Secrecy, DNSSEC, DANE, DMARC, and DKIM to secure your connection to Tutanota to the maximum.

Check here for more info on Tutanota’s TLS encryption.

Tutanota ensures users that even they cannot access your inbox, due to the open source encryption standards they use.

AES-128 is more than secure enough for protecting your messages. Reportedly even the fastest computers in the world would need many billions of years to crack AES-128.

Tutanota is currently working together with Leibniz University Hanover to make their encryption standards future-proof against quantum computer attacks.

Tutanota hands-on testing

We’ve based this review on the browser-based client. If you decide to stick with Tutanota, you can easily upgrade to a paid plan, with similar functionality and more storage, email aliases, and other options.

Signing up for Tutanota

Signing up for Tutanota goes about the way you would expect. Click the Sign Up button on Tutanota.com to begin the process.

The first step will be to choose your service plan.

On the Subscription screen, click the red Select button under the plan you want to use. Although I have been using Tutanota since 2017, for purposes of this review, I have created a new, Free private account. This is the ideal way to test out the service. I suggest you do the same.

Next you will need to enter your account information. You’ll select an email address using one of the domain names Tutanota makes available for free users. You’ll also need to enter a Password, and check all the relevant boxes on the screen, including the one that confirms you are at least 16 years old.

Note that you are not required to give Tutanota a phone number or other personally identifiable information. This means you can have a truly anonymous free account. As we’ll see in a moment, Tutanota has a process in place to prevent spammers from taking advantage of the service. Unfortunately, that process can be a real headache for regular people.

Hit the red Next button to move on. There is one step left. That’s to record your 64-character Recovery Code. Tutanota doesn’t know your password (or the optional second factor you can set later) so the only way to recover your account if you lose either of these is by using the Recovery Code.

You can copy the code by hand, or click the round Copy or Print buttons. Once you’ve recorded your code, hit Ok and you’ll be ready to log in. Enter your Password and hit the Log in button.

An annoying automated delay

You are probably anxious to get into Tutanota and start exploring, but at this point you may run into that anti-spammer process we mentioned earlier. Your account may be automatically “marked for approval.” This puts a 48-hour hold on your ability to send or receive messages, as described below.

As Tutanota states in this blog post,

Sometimes accounts are automatically marked for [manual] approval to prevent spammers from signing up. This is often the case when you sign up via Tor or a VPN, for example, because unfortunately spammers like to abuse Tor. In case your account gets marked for approval, you will be able to start using it within 48 hours after registration once it has been approved.

They claim that your account will automatically be approved within 48 hours after registration. However, if your account has not been approved after 48 hours, Tutanota recommends you contact Support and give them the email address you are trying to register.

I ran into a problem with this system while working on this review. After waiting four days, I contacted Support about the problem, and someone got back to me within minutes. However, the account was not approved until the 5th day. Not ideal.

On a positive note, this manual account approval takes the place of more invasive verification procedures, such as phone verification, which many other email providers use. While the delay was somewhat annoying, I’d still take this over phone verification.

The look and feel of Tutanota

Once you click Ok, you will see a large welcome message, with the most important bit reminding you about not losing your password.

Welcome to your secure & ad-free Tutanota mailbox, protected with strong encryption. Even we, the developers, do not have the ability to access it. You are the only one who can decrypt your emails and contacts with your password. Please make sure you don’t lose your password as it cannot be reset.

I spoke with Tutanota Support about this and they acknowledged that this message is now out of date since the addition of the Recovery Phrase. As long as you have your Recovery Phrase, you can regain access to your account even without the password.

As you’ve seen if you got this far, Tutanota uses a standard, 3-pane layout like most other email programs. One feature you may like is the built-in support for a Dark mode, which looks like this:

If you happen to work a lot at night, or just get tired of the glare from the screen, this mode could be for you.

The folder list appears on the left, with messages in the center, and the content of the selected message on the right. A basic set of folders comes pre-defined in the left-most pane, and you can create more at will.

By default, Tutanota blocks images from appearing. If a message contains images, you can display them by clicking this icon at the top right of the message:

Note: Tutanota will automatically switch to a 2-pane view on smaller displays, such as tablets.

Composing, sending, and receiving messages

Composing messages works as you would expect. Click the Pencil icon at the bottom right of the Tutanota window to create a new message. While an early complaint about Tutanota was the lack of message formatting commands, today there is a full range of formatting options. To see the menu of formatting options, click the T icon next to the Paperclip (attachment) icon on the Subject line of the new message.

Click Send to transmit the message.

When you receive messages you open them normally, whether received from a Tutanota user or someone else. If a message is from another Tutanota user, all the encrypting and decrypting is done automatically in the background.

So far, so good. But what if you want to send a message to a person who doesn’t use Tutanota? This is where things get a bit more complicated.

Sending messages to non-Tutanota users

When you are composing a message, Tutanota checks to see if the recipient is a Tutanota user or not. If not, you have to specify whether you want the message to be sent encrypted or not. If you have this option, Tutanota will display a lock icon on the Subject line, like this, with a status message below:

Clicking the lock icon will cause Tutanota to send the message either in the clear as above, or end-to-end encrypted as shown below:

When sending an encrypted message to a non-Tutanota user, you must enter a pre-agreed password that is used for symmetrically encrypting and decrypting the message. Instead of receiving the message in its encrypted form, the recipient will receive a link to view the message.

Searching for messages

Tutanota has implemented a full text search feature for messages. This is actually a challenging endeavor since the contents of your inbox are stored fully encrypted.

When you enter a term to search for, Tutanota will create an encrypted search index. This might take a minute or two depending on the size of your inbox. Like messages and everything else in Tutanota, the search index is encrypted at rest. This prevents someone from hacking into your system and spying on you by analyzing the search index.

After the search index is populated, the matching hits (emails) will display below. Tutanota’s search feature also gives you the ability to search specific periods of time as well as custom fields (subject, email body, from/to, and attachment name). This is a pretty good system in my opinion.

Comparison: With ProtonMail, searches can only be performed on subject lines, which ProtonMail leaves unencrypted.

Rules and Filters

Tutanota offers both rules and filters for email, but they are pretty basic. Under the Spam rules you can designate individual email addresses as spam (put in the Spam folder), not spam (leave in the Inbox), or discard (send to the Trash folder).

Mailbox rules are more flexible, but are only available as part of paid plans.

Contacts and calendars

Tutanota supports both Contacts and Calendars.

These function as you would expect, but it is important to note that all Contacts and Calendars are encrypted when at rest. As we noted earlier, one of the main goals for the Tutanota team is for all your data to be encrypted, protecting you from snooping third parties.

The encrypted calendar was officially released in July 2019.

You can see the calendar features here.

Tutanota mobile apps (Android and iOS)

Tutanota has apps for both iOS and Android. I’ve been working with the Android app.

Whereas I had some issues with it when it first came out, it now functions well. At the time of this review, the Tutanota Android app had almost 3,400 reviews with a rating of 4.4 out of 5 stars. (Available on F-Droid here.)

Tutanota desktop client

Tutanota has a desktop client (currently in beta) for Windows, Mac OS, and Linux. I’ve been testing it out with my Tutanota account and I’ve found it to work well, basically giving you all the features of the webmail app. This should offer more security than browser-based email clients when it’s out of beta.

The Tutanota desktop client is based on Electron. They decided to use Electron, rather than build custom clients, for the following reasons:

• We are able to support all three major operating systems with minimum effort.
• We can quickly adapt the new desktop clients so that they match new features added to the webmail client.
• We can allocate development time to particular desktop features, e.g. offline availablity, email import, that will simultaneously be available in all three desktop clients.

You can learn more about the Tutanota desktop client here.

Is Tutanota really secure?

Tutanota is certainly more secure than the vast majority of email services. Is it bulletproof? No. No system is, so you have to think about your threat model and decide if any given service is secure enough for your purposes. So let’s take a look at potential weaknesses in Tutanota’s security.

1. The browser-based version of Tutanota relies on JavaScript for encryption and decryption. Using JavaScript for these functions is generally considered to be less secure than other approaches. (Tip: use a secure browser when accessing your Tutanota inbox.)
2. There are some cases where Tutanota is bound by law to disclose information about you. According to their Transparency Report, between July 1, 2018 and December 31, 2018, Tutanota released data to the authorities more than two dozen times. Understanding exactly what this means is complicated. If you want the details, you will need to examine the latest Transparency Report and related documents. It is important to note that in some cases, Tutanota may be forced to record IP Addresses by a valid court order, as well as the contents of messages that arrive unencrypted at a user’s mailbox.
3. Tutanota implemented a recovery code feature in November 2018, which garnered some mixed reactions from their user base. While some were upset about the new feature, the security and logic behind it seem sound. This allows people to securely reset their password without using a recovery email (not secure) and not having to get Tutanota support involved. Keep in mind that Tutanota cannot see the recovery code and it is also open source.

Note: All email services must abide by the laws in the jurisdiction in which they are based. To have more anonymity when you use Tutanota (or any email service), consider using a good VPN service, which encrypts your traffic and hides your real IP address.

Tutanota business features

Tutanota also offers secure business email accounts designed to let you,

Save time and money by hosting all your business emails end-to-end encrypted on Tutanota’s secure servers based in Germany.

Here’s a partial list of the Business Email features currently available:

• Custom email domains with optional catch-all
• The Secure Connect encrypted contact form
• Multi-user support so you can manage all your users yourself
• Scalable shared storage for all your business accounts
• Zero-knowledge full text search of messages and contacts
• A large set of Whitelabel customizations
• Two Factor Authentication (2FA) available

Secure Connect encrypted contact form

One of the reasons I switched this website’s email over to Tutanota was the ability to incorporate an encrypted contact form that facilitates completely anonymous two-way communication. Before this was officially launched as “Secure Connect”, I was using it here on Net Todays. In May, 2019, Tutanota launched Secure Connect and made it, “free for news sites so that whistleblowers can get in touch with journalists securely.” Very cool.

Unfortunately, if you don’t meet the criteria to get it free (not a news site) then this feature will cost you €240 per year – certainly not cheap. I’ve been using Secure Connect for over a year now and highly recommend it for website owners.

Tutanota support

For this review, I created a fresh account and went through the setup process as an average user.

I contacted Tutanota Support twice during this review process. In the first case, I contacted them about the use of the Recovery Phrase to recover your account if you lost your password. I wrote to them more or less the middle of the night in Germany, and they got back to me early the next day.

The second time I contacted them was due to the delay in getting my new test account approved. Their claimed wait time is 48 hours, but I was still waiting 96+ hours later. (The account was approved on the fifth day.)

With Tutanota being a small team using internal support, I understand there may be some delays in support. Hopefully, this was a temporary hiccup (with the 5 day delay on account creation) and not the norm.

Over the past few years of personally using Tutanota, all of my support inquiries were responded to in about one business day – so overall very good.

How much does Tutanota cost? Plans and Pricing

Tutanota pricing has grown more complicated over time. They now offer six plans (three Private plans and three Commercial plans) along with a range of custom options. This allows you to create exactly the service you need for your personal or business needs.

At the time of this Tutanota review, here is a breakdown of the plans and prices

• Free Private plan, €0
• Premium Private plan, €12 yearly, €1.20 monthly
• Pro Private plan, €60 yearly, €6 monthly
• Premium Business plan, €12 yearly, €1.20 monthly
• Pro Business plan, €60 yearly, €6 monthly

Beyond the standard plans you can add more storage (10 GB, 100 GB, 1 TB), and more email aliases (20, 40, 100). As if this wasn’t complicated enough, the company keeps adding useful new features like Whitelabel and Secure Connect to their product. As a result, your best option is to scroll down the Pricing page to the Pricing Calculator and let it give you an exact price for the particular configuration you want.

Note: If you are an NPO (non-profit organization), you may be entitled to a reduced price on Tutanota. See here for details.

No cryptocurrency payment options!

Unfortunately, Tutanota has still not integrated support for cryptocurrency payment options, such as Bitcoin and Monero.

This has been on their Roadmap for a while now. You can donate to them with cryptocurrency, but standard crypto payments are still not an option. If you want more privacy with payments, you could use a service like Privacy.com, which allows you to create virtual credit cards and use any name/address you want for payments.

Is Tutanota the best secure email service for you?

Is Tutanota the best secure email service for you? Here is a summary of the factors to consider when switching to a secure email service, and how they apply to Tutanota:

• Jurisdiction – Tutanota is based in Germany and your data is stored there.
• PGP support – Does not support PGP (read about PGP problems).
• Import feature – While it has been discussed for more than a year, Tutanota still cannot import email messages. It can import calendar data and contacts.
• Email apps – A web-based client as well as desktop apps for Windows, macOS, and Linux, along with iOS and Android apps.
• Encryption – Emails and attachments can be sent end-to-end encrypted and everything is stored encrypted at rest.
• Features – Includes a built-in calendar and contacts along with full text search of messages.

Tutanota alternatives

If Tutanota doesn’t look like the secure email service for you, you may want to check out ProtonMail. The services are similar, although we like Tutanota’s approach to message encryption better since it encrypts the Subject line as well as the body of the message.

That said, either one of these services should be more than sufficient for normal users who want to protect their privacy while using email. Neither service can guarantee you protection against state actors like the NSA or the various domestic intelligence agencies.

You can also see our secure email roundup for a list of other providers.

Tutanota review conclusion

Tutanota is a strong choice for anyone who wants a secure email service for general use. For more security, you can use the desktop or mobile clients, or access the browser-based app through a good VPN with a secure browser.

While Tutanota may not get as much attention as some other email providers, we believe it is a market leader in the secure email space, if not the best option available for serious users. Check it out here.

Final Disclaimer and Instructions from NetTodays

NetTodays is a platform for Best VPN Review and Which VPN Service is Best for you.  How to get Best Free VPN Review without the expense. NetTodays suggest how to utilize the most recent VPN and reviews about What is the Best VPN for Netflix. Best VPN built for speed, you can select a server at the country or city level and can favorite a location for future use. NetTodays help you to understand that What is the Best VPN on the Market. NetTodays provide you all these reviews and recondition about Best VPNs for Gaming

A VPN is a service that both encrypts your data and hides your IP address by bouncing your network activity through a secure chain to another server miles away. This obscures your online identity, even on public Wi-Fi networks, so you can browse the internet safely, securely, and anonymously.

NetTodays gives you answers to all questions which are in your mind about VPN.

NetTodays also suggest continually utilizing Best VPN when you are using a newer Wi-Fi Network. Here is a decent dependable guideline: If you’re away from the workplace or home, and you’re utilizing another person’s Wi-Fi (even that of a relative or a companion, since you can’t be sure whether they’ve been compromised), utilize a VPN. It’s especially significant in case you’re getting to help that has specifically distinguishing data. Keep in mind, a great deal goes on in the background, and you never truly know whether at least one of your applications is verifying behind the scenes and putting your data in danger.