Like it or not, email is a critical part of our digital lives. It’s how we sign up for accounts, get notifications, and communicate with a wide range of entities online. Critics of email rightfully point out that email suffers from a significant number of flaws that make it less than ideal, but that doesn’t change the current reality. In light of the facts, I believe that an encrypted email provider is a must-have for everyone in today’s age of rampant data breaches, insider threats, warrantless police access, and targeted advertising. If I can get access to your emails, I can get a range of sensitive information including where you bank, communications with medical services, calendar reminders, news announcements from family, and more. So this week, let’s look into the top encrypted email providers The New Oil recommends and their features to help decide which one is right for you.

Defining “Secure”

Before I offer my suggestions, I should take a moment to explain how I define “secure” email since marketing can mean basically anything. “Secure email,” to me, means an email provider who enforces zero-knowledge encryption; that is to say a provider who cannot access your emails as they're sitting in your inbox. It’s not enough to simply pinky promise to respect your privacy. If they can access your data, so can an attacker who gains access whether a cybercriminal, a crooked employee, or a government with a court order. Likewise, services should apply that encryption automatically wherever possible. The onus should not be upon the users for you to go generate your own PGP keys (or whatever security protocol the provider is built upon) and apply it yourself. I also expect the clients (aka apps) of the service to be source available so that qualified, interested parties can verify that everything is implemented correctly and doing what it claims to. Security is important and easy to mess up. Readers can see my full list of criteria here.

Notes: This list is in alphabetical order. It also contains affiliate links for Proton and Tuta that will help support us if you choose to use one of these services.

Proton

Image courtesy of Proton

Proton is by far the biggest name in the privacy space, particularly when it comes to email and VPN, though in recent years they’ve begun to roll out a full suite of products like cloud storage, a calendar, a password manager, and a Bitcoin wallet. Proton is aiming to become a user-friendly all-in-one suite, a great replacement for Google or Apple geared toward mainstream users. Of course, there is something to be said for not putting all your eggs in one basket, but for those who prefer the ecosystem approach to their services, Proton is a powerful service. In addition, Proton is compatible with PGP, meaning that other PGP users can initiate a secure conversation with you even if they’re not Proton users (though you will have to dig through the settings to find your public key first). Proton offers a free tier you can use to test it out if you so choose.

The main drawback of Proton – in my opinion – is feature parity. Proton operates under the philosophy of “if something is usable, why wait to publish it?” As such, they are notorious for publishing apps that – while functional – are still missing a number of features and need fine-tuning or that may be available on one platform and not another. On the plus side, this allows them to prioritize much-wanted features thanks to the immediate feedback from the community. On the other hand, this often results in situations where a feature in the iPhone app is missing from the Android app (or vice versa) or a Windows app is available while Mac and Linux are still in beta (if available at all). I also have to note personally that lately Proton's support has been abysmal. I've contacted them several times recently only to get emails weeks later basically saying “sorry for the delay, do you still need assistance?” I'm still waiting for assistance. And I'm paying for the Unlimited plan.

Tuta

Image courtesy of Tuta

Tuta – formerly Tutanota – is Proton’s main competitor, and unlike many competitors in the tech space they do actually set themselves apart quite considerably. Tuta is based out of Germany and currently offers a calendar in addition to their email. On the user-facing end, Tuta users will notice a much more consistent user experience across the board compared to Proton: all the apps should more or less have the same features regardless of your operating system. Behind the scenes, Tuta is not based on PGP directly (you can see more details here for technical readers). The advantage of Tuta's encryption implementation is that it protects more metadata than traditional PGP, such as the email subject line. The drawback, however, means that only other Tuta users can initiate an end-to-end encrypted conversation with you.

Tuta's drawbacks compared to Proton consistent of fewer features, fewer offerings in their suite (there's cloud storage coming in the future, but no VPN or password manager), and the apps are considered by some to be a bit slow and dated in appearance. But for those who aren't bothered by that, Tuta offers innovative, strong features with a consistent experience, and great support.

Proton and Tuta are the two most popular encrypted email providers, and with good cause. They check all the boxes and users really can’t go wrong with either. However, some users may find that these providers don't meet their needs. So in the interest of offering more options to readers, here's a few honorable mentions worth considering.

Honorable Mention: Posteo

Image courtesy of Posteo

Posteo is a Germany-based email provider that includes a calendar. Their main features are their reliance on green, renewable energy and their commitment to privacy and ad-free services, even for unencrypted accounts. Therein, however, lies the main reason Posteo is an “honorable mention”: they do not offer end-to-end encryption by default. Users are expected to generate their own PGP keys which they can upload to the service to enable zero-knowledge encryption. For advanced users who aren't afraid to self-manage this kind of stuff, this is great. It creates the maximum level of trust and allows you to manage everything yourself. However, for non-techy users, this can create a false sense of security compared to Proton or Tuta, especially when the website uses (arguably) tricky wording like “all data can be encrypted.” While they do specify on the features page that they use TLS by default, this all can still be confusing for a non-technical person to parse. As a double-edged sword, Posteo has no free tier (but they do offer a 14-day free trial and their pricing starts at a very affordable €1/month). On the plus side, this creates a sustainable business model that doesn't have to rely on selling data to fund the service, however it is a barrier to entry for those on a very tight budget.

Honorable Mention: Mailbox

Image courtesy of Mailbox

In a similar vein to Posteo, the other honorable mention worth considering is Mailbox. Mailbox is also based in Germany and promises renewable energy sources. Like Posteo, Mailbox offers a free trial (a generous 30 days compared to Posteo's 14 days) and their lowest tier is €1/month. Also like Posteo, however, Mailbox requires users to add their own PGP keys, and thus has the same pros and cons of Posteo. The main difference that seems to separate Mailbox and Posteo is target audience: Posteo is marketed more toward private end-users while Mailbox offers a number of features aimed at organizations (though they both appear reasonably user-friendly). If you're a little more advanced, Mailbox will likely speak to you with their additional privacy and security offerings.

In Defense of Encrypted Email

Critics of encrypted email will note that in most cases, using such a provider is only a half-protection. In nearly all email exchanges, you're corresponding with someone who's not using encrypted email – perhaps Gmail or Microsoft – so the email remains accessible on their end. This is true, however to me this is a defeatist argument. While it is important to keep that caveat in mind when communicating, by using a secure email yourself, you're cutting your attack surface in half. Your emails still can't be accessed without your knowledge. A data breach, illicit password reset, or warrantless access will only result in the attacker gaining access to a bunch of unusable gibberish. Also, if the other party gets compromised, only the correspondence you've had with them gets compromised. Depending on that other party, that may be limited to something innocuous (like a support ticket) or something serious (like financial or medical information), but it won't result in all of that getting compromised like it would if your inbox got accessed.

When I ask these same critics for their proposed solution to the problems with email, the response is invariably along the lines of “people should be using something like Signal instead.” While that would be nice, my bank isn’t going to Signal me notifications any time for the foreseeable future. Or my veterinarian, or a job interview, or a receipt for an online purchase, and so on. I have a longstanding challenge to show me the person who functions in modern western society – has a job, pays bills, has a social life, etc – without email (truly without email, not “my grandpa never uses it, my grandma handles it for him.”) To date, nobody has produced such a person. Like it or not, email is a critical component of modern digital life. Perhaps that will change someday, and if it does I’ll be quite happy to revise my stance. But for now, it’s a necessary evil and therefore – just like every other facet of digital life – we should strive to reduce the risks as much as possible. If you’re not using an encrypted email provider, I strongly to encourage you to start immediately. There are likely other great options out there for more advanced users who want different features, but for most mainstream users one of the choices on this list will be a great place to start.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...