Why Email Encryption Matters
Email is built on SMTP, a protocol designed in the 1970s that did not include content encryption in its original specification. While TLS encryption during transit has become widespread, email content is still stored in plaintext on mail servers in many cases.
Major email services like Gmail, Outlook, and Yahoo Mail scan email content for advertising targeting and service improvement. While Google announced in 2017 that it would stop scanning Gmail for advertising purposes, scanning for machine learning model training and smart features continues. Protecting your digital footprint starts with securing your most fundamental communication channel.
Encrypted email services use end-to-end encryption (E2EE) to make it technically impossible for anyone other than the sender and recipient to read email content. Some services implement "zero-access encryption," where even the service provider itself cannot access email content.
Proton Mail: The Pioneer of Encrypted Email
Overview and Features
Proton Mail was founded in Switzerland in 2014 by researchers from CERN. Operating under Switzerland's strict privacy laws, it has grown to serve over 100 million users as of 2025, making it the largest encrypted email provider.
Proton Mail achieves end-to-end encryption directly in the web browser, with all encryption and decryption performed client-side. Since user private keys are never stored on the server, Proton itself cannot read email content. Combined with robust phishing detection capabilities, Proton Mail provides comprehensive email protection. For a deeper understanding of the underlying technology, consider reading books on email encryption.
Key Features
- End-to-end encryption (automatic between Proton Mail users; password-protected emails for external users)
- Zero-access encryption (emails stored encrypted on servers)
- Self-destructing emails (messages with expiration dates)
- Custom domain support (paid plans)
- Integration with Proton Calendar, Proton Drive, and Proton VPN
- OpenPGP standard compliance
- Tor access support (onion address provided)
Pricing Plans (2025–2026)
- Free: 1 GB storage, 1 email address, up to 150 messages per day
- Mail Plus: Approximately €4/month, 15 GB storage, 10 email addresses
- Proton Unlimited: Approximately €10/month, 500 GB storage, access to all Proton services
Tuta: Encrypted Email from Germany
Overview and Features
Tuta (formerly Tutanota) was founded in Germany in 2011. Operating under the EU's GDPR, it employs a proprietary encryption protocol. The service announced its rebranding from Tutanota to Tuta in November 2023.
Tuta's distinguishing feature is that it encrypts not only the email body but also the subject line, sender name, and attachments. While many encrypted email services leave subject lines unencrypted, Tuta focuses on metadata protection as well.
Key Features
- Full encryption of email body, subject line, and attachments
- Proprietary TutaCrypt encryption protocol (AES-256 plus a hybrid Kyber + X25519 key exchange, replacing the legacy RSA-2048 scheme since March 2024)
- Password-protected emails for external users
- Encrypted calendar
- Custom domain support (paid plans)
- Open source (client code published on GitHub)
- Anonymous account creation (no phone number required)
Pricing Plans (2025–2026)
- Free: 1 GB storage, 1 email address
- Revolutionary: Approximately €3/month, 20 GB storage, 15 email addresses, custom domains
- Legend: Approximately €8/month, 500 GB storage, 30 email addresses
Mailfence: Feature-Rich Encrypted Email
Overview and Features
Mailfence was founded in Belgium in 2013. Operating under Belgian privacy law, it is one of the few services that supports both OpenPGP and S/MIME encryption standards.
Mailfence's strength lies in its integrated groupware features beyond email, including calendar, contacts, documents, and chat. It offers a feature set well-suited for business and team use.
Key Features
- End-to-end encryption via OpenPGP and S/MIME
- Digital signatures for email authenticity verification
- Encrypted calendar, contact management, and document storage
- Group features (shared calendars, shared documents)
- Custom domain support
- IMAP/SMTP/POP3 support (integration with external email clients)
- Two-factor authentication (TOTP)
Pricing Plans (2025–2026)
- Free: 500 MB storage, basic features
- Entry: Approximately €2.50/month, 5 GB storage
- Pro: Approximately €7.50/month, 20 GB storage, all features
- Ultra: Approximately €25/month, 50 GB storage, priority support
Comparing the Three Services
Encryption Approach
Proton Mail adopts the OpenPGP standard, achieving transparent encryption in the web browser. Tuta uses a proprietary encryption protocol that extends to metadata encryption including subject lines. Mailfence supports both OpenPGP and S/MIME, offering the highest compatibility with existing encryption infrastructure.
Ease of Use
Proton Mail features a polished UI and intuitive operation, making it accessible even for encrypted email beginners. Tuta also provides a simple and user-friendly interface. Mailfence, while feature-rich, has more configuration options and a somewhat steeper learning curve.
Security and Privacy
All three services maintain high security standards, but with different approaches. Proton Mail leverages Swiss legal protections and proprietary infrastructure. Tuta leads with metadata protection and post-quantum cryptography already in production through TutaCrypt. Mailfence's S/MIME support facilitates integration with existing corporate security policies.
Migration from Existing Email
All three services provide migration tools for importing from Gmail and Outlook. Proton Mail offers particularly robust migration tools, with its Easy Switch feature enabling one-click migration from Gmail, Yahoo Mail, and Outlook. When migrating, it is also recommended to review the basics of email security.
Getting Started with Encrypted Email
Step 1: Choose a Service
Select a service based on your use case. For maximum personal privacy, choose Proton Mail. For metadata protection, choose Tuta. For team use or S/MIME requirements, Mailfence is the best fit.
Step 2: Create an Account and Configure Security
- Create an account with your chosen service
- Set a strong password (follow password security best practices)
- Enable two-factor authentication (see two-factor authentication setup guide)
- Securely store your recovery email or recovery phrase
Step 3: Migrate from Your Existing Email
- Use migration tools to import existing emails
- Notify important contacts of your new email address
- Migrate gradually, setting up forwarding from your old address for a transition period
- After migration is complete, delete data from your old email service
Step 4: Combine with Secure Messaging
Encrypted email is an important defense, but for real-time communication, combining it with encrypted messaging apps like Signal or Element is effective. Using the right tool for each purpose improves your overall communication security.
Latest Developments in 2025–2026
Proton Mail New Features
Proton Mail launched Proton Scribe, a privacy-respecting writing assistant that runs entirely on Proton's infrastructure, in 2025. Additionally, Dark Web Monitoring was introduced to alert users when their email addresses appear in data breaches. The Proton ecosystem continues to expand with tighter integration between Mail, Calendar, Drive, VPN, and the new Proton Pass password manager.
Tuta's TutaCrypt Post-Quantum Encryption
Tuta launched TutaCrypt, its post-quantum encryption protocol, in March 2024. TutaCrypt is a hybrid scheme that combines the CRYSTALS-Kyber key encapsulation mechanism with an X25519 elliptic-curve key exchange, and it is available on all plans including the free tier. This made Tuta one of the first email providers to deploy post-quantum encryption at scale, defending against "Harvest Now, Decrypt Later" attacks from future quantum computers. Proton Mail followed in May 2026, offering opt-in post-quantum protection on all plans.
Apple iCloud Mail Is Not End-to-End Encrypted
Even with Apple's Advanced Data Protection enabled, iCloud Mail is not end-to-end encrypted. Apple's documentation states that iCloud Mail, Contacts, and Calendar are excluded from E2EE because they need to interoperate with the global email and scheduling systems. iCloud Mail relies on standard TLS in transit and encryption at rest, so if you need true end-to-end encryption for email content, use S/MIME on top of iCloud Mail or a dedicated encrypted email service such as Proton Mail or Tuta.
Post-Quantum Cryptography Migration
The advancement of quantum computing has raised concerns about the future vulnerability of current RSA and elliptic curve cryptography. Proton Mail integrated post-quantum cryptography into OpenPGP.js in 2024, and Tuta's TutaCrypt has set the standard for quantum-resistant email encryption. Early migration to post-quantum cryptography is considered critical as a defense against harvest-now-decrypt-later attacks. A guide to post-quantum cryptography offers valuable insight into these emerging standards.
eIDAS 2.0 and Regulatory Changes
The EU's eIDAS 2.0 regulation has updated the legal framework for electronic signatures, authentication, and trust services. The regulation mandates that EU member states provide citizens with a European Digital Identity Wallet by 2026, which will integrate with email authentication. S/MIME support in encrypted email services plays an increasingly important role in meeting corporate compliance requirements within this evolving regulatory landscape.
Improved Interoperability
Interoperability between encrypted email services is gradually improving. While Proton Mail and Tuta use different encryption methods, their password-protected email features for external users enable secure communication with recipients who do not use encrypted email services. The emergence of the MLS (Messaging Layer Security) protocol may further improve cross-provider encrypted communication in the future.
Summary
Encrypted email services fundamentally protect the privacy of email communications. Proton Mail excels in ease of use and ecosystem integration, Tuta in metadata protection and advanced cryptography, and Mailfence in feature richness and compatibility with existing infrastructure.
Start by checking your current connection security on IP Check-san, review the basics of email security, and then consider migrating to an encrypted email service that fits your usage style.
Related Glossary Terms
Frequently Asked Questions
What is the main difference between Proton Mail and Tuta?
Proton Mail adopts the OpenPGP standard and benefits from Swiss legal protections, with a polished UI that suits beginners. Tuta, based in Germany, uses a proprietary encryption protocol that encrypts not only the email body but also the subject line, sender name, and attachments, putting extra focus on metadata protection.
Do encrypted email services have free plans?
Yes. All three services offer free plans: Proton Mail provides 1 GB of storage, 1 email address, and up to 150 messages per day; Tuta offers 1 GB of storage and 1 email address; Mailfence includes 500 MB of storage with basic features.