For everything else, we recommend a variety of email providers based on sustainable business models and built-in security and privacy features. Read our full list of criteria for more information.

| Provider | OpenPGP / WKD | IMAP / SMTP | Encrypted Storage | Anonymous Payment Methods |

|---|---|---|---|---|

| Proton Mail | | Paid plans only | | Cash Monero via third party |

| Mailbox Mail | | | Mail only | Cash |

| Tuta | | | | Monero via third party Cash via third party |

In addition to (or instead of) an email provider recommended here, you may wish to consider a dedicated Tcf362femail aliasing service to protect your privacy. Among other things, these services can help protect your real inbox from spam, prevent marketers from correlating your accounts, and encrypt all incoming messages with PGP.

* Tcf362fMore Information

These providers natively support OpenPGP encryption/decryption and the Tcf362fWeb Key Directory (WKD) standard, allowing for provider-agnostic end-to-end encrypted emails. For example, a Proton Mail user could send an E2EE message to a Mailbox Mail user, or you could receive OpenPGP-encrypted notifications from internet services which support it.

* Proton Mail

* Mailbox Mail

When using E2EE technology like OpenPGP your email will still have some metadata that is not encrypted in the header of the email, generally including the subject line! Read more about Tcf362femail metadata.

OpenPGP also does not support forward secrecy, which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed.

* Tcf362fHow do I protect my private keys?

Proton Mail is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since 2013. Proton AG is based in Geneva, Switzerland.

The Proton Free plan comes with 500 MB of Mail storage, which you can increase up to 1 GB for free.

Homepage (https://proton.me/mail)

* Google Play (https://play.google.com/store/apps/details?id=ch.protonmail.android)

* App Store (https://apps.apple.com/app/id979659905)

* GitHub (https://github.com/ProtonMail/android-mail/releases)

* Windows (https://proton.me/mail/bridge#download)

* macOS (https://proton.me/mail/bridge#download)

* Linux (https://proton.me/mail/bridge#download)

* Web (https://mail.proton.me)

Free accounts have some limitations, such as not being able to search body text and not having access to Proton Mail Bridge (https://proton.me/mail/bridge), which is required to use a Tcf362frecommended desktop email client such as Thunderbird. Paid accounts include features like Proton Mail Bridge, additional storage, and custom domain support. The Proton Unlimited plan or any multi-user Proton plan includes access to Tcf362fSimpleLogin Premium.

A letter of attestation (https://res.cloudinary.com/dbulfrlrz/images/v1714639878/wp-pme/letter-of-attestation-proton-mail-20211109_3138714c61/letter-of-attestation-proton-mail-20211109_3138714c61.pdf) was provided for Proton Mail's apps in November 2021 by Securitum (https://research.securitum.com).

Proton Mail has internal crash reports that are not shared with third parties and can be disabled.

=== "Web"

From your inbox, select → All Settings → Account → Security and privacy → Privacy and data collection.

* [ ] Disable Collect usage dignostics

* [ ] Disable Send crash reports

=== "Mobile"

From your inbox, select → Settings → select your username.

* [ ] Disable Send crash reports

* [ ] Disable Collect usage dignostics

Paid Proton Mail subscribers can use their own domain with the service or a catch-all (https://proton.me/support/catch-all) address. Proton Mail also supports sub-addressing (https://proton.me/support/creating-aliases), which is useful for people who don't want to purchase a domain.

Proton Mail accepts (https://proton.me/support/payment-options) cash by mail in addition to standard credit/debit card, Tcf362fBitcoin, and PayPal payments. Additionally, you can use Tcf362fMonero to purchase vouchers for Proton Mail Plus or Proton Unlimited via their official (https://discuss.privacyguides.net/t/add-monero-as-an-anonymous-payment-method-for-proton-services/31058/15) reseller ProxyStore (https://dys2p.com/en/2025-09-09-proton.html).

Proton Mail supports TOTP two-factor authentication (https://proton.me/support/two-factor-authentication-2fa) and hardware security keys (https://proton.me/support/2fa-security-key) using FIDO2 or U2F standards. The use of a hardware security key requires setting up TOTP two-factor authentication first.

Proton Mail stores your emails (https://proton.me/blog/zero-access-encryption) and calendars (https://proton.me/news/protoncalendar-security-model) with PGP-based encryption at rest, where only you have the decryption keys needed to access them later.

Certain information stored in Proton Contacts (https://proton.me/support/proton-contacts), such as display names and email addresses, are not secured with your own encryption keys, so Proton is able to read them. Contact fields which are protected with your own encryption keys, such as phone numbers, are indicated with a padlock icon.

Proton Mail has integrated OpenPGP encryption (https://proton.me/support/how-to-use-pgp) in their webmail. Emails to other Proton Mail accounts are encrypted automatically, and encryption to non-Proton Mail addresses with an OpenPGP key can be enabled easily in your account settings. Proton also supports automatic external key discovery with WKD. This means that emails sent to other providers which use WKD will be automatically encrypted with OpenPGP as well, without the need to manually exchange public PGP keys with your contacts. They also allow you to encrypt messages to non-Proton Mail addresses without OpenPGP (https://proton.me/support/password-protected-emails), without the need for them to sign up for a Proton Mail account.

Proton Mail also publishes the public keys of Proton accounts via HTTP from their WKD. This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Proton's own domains, like '@proton.me'. If you use a custom domain, you must Tcf362fconfigure WKD separately.

If you have a paid account and your bill is unpaid (https://proton.me/support/delinquency) after 14 days, you won't be able to access your data. After 30 days, your account will become delinquent and won't receive incoming mail. You will continue to be billed during this period. Proton will delete inactive free accounts (https://proton.me/support/inactive-accounts) after one year. You cannot reuse the email address of a deactivated account.

Proton Mail's Unlimited (https://proton.me/support/proton-plans#proton-unlimited) plan also enables access to other Proton services in addition to providing multiple custom domains, unlimited hide-my-email aliases, and 500 GB of storage.

Mailbox Mail (formerly Mailbox.org) is an email service with a focus on being secure, ad-free, and powered by 100% eco-friendly energy. They have been in operation since 2014. Mailbox Mail is based in Berlin, Germany.

Accounts start with up to 2 GB storage, which can be upgraded as needed.

Homepage (https://mailbox.org)

* Web (https://login.mailbox.org)

z

Mailbox Mail lets you use your own domain, and they support catch-all (https://kb.mailbox.org/en/private/custom-domains/use-your-own-domain-with-catch-all/) addresses. Mailbox Mail also supports sub-addressing (https://kb.mailbox.org/en/private/e-mail/what-is-an-alias-and-how-do-i-use-it/), which is useful if you don't want to purchase a domain.

Mailbox Mail doesn't accept any cryptocurrencies as a result of their payment processor BitPay suspending operations in Germany. However, they do accept cash by mail, cash payment to bank account, bank transfer, credit card, PayPal, and a couple of German-specific processors: Paydirekt and Sofortüberweisung.

Mailbox Mail supports two-factor authentication (https://kb.mailbox.org/en/private/security-and-privacy/how-to-use-two-factor-authentication-2fa/) for their webmail only. You can use either TOTP or a Tcf362fYubiKey via the YubiCloud (https://yubico.com/products/services-software/yubicloud). Web standards such as Tcf362fWebAuthn are not yet supported.

Mailbox Mail allows for encryption of incoming mail using their encrypted mailbox (https://kb.mailbox.org/en/private/encryption/your-encrypted-mailbox/). New messages that you receive will then be immediately encrypted with your public key.

However, Open-Xchange (https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox Mail, does not support (https://kb.mailbox.org/en/business/security-privacy-article/encryption-of-calendar-and-address-book/) the encryption of your address book and calendar. A Tcf362fstandalone option may be more appropriate for that data.

Mailbox Mail has integrated encryption (https://kb.mailbox.org/en/private/encryption/how-can-e-mails-be-encrypted-with-pgp/) in their webmail, which simplifies sending messages to people with public OpenPGP keys. They also allow remote recipients to decrypt an email (https://kb.mailbox.org/en/private/encryption/my-recipient-does-not-use-pgp/) on Mailbox Mail's servers. This feature is useful when the remote recipient does not have OpenPGP and cannot decrypt a copy of the email in their own mailbox.

Mailbox Mail also supports the discovery of public keys via HTTP from their WKD. This allows people outside of Mailbox Mail to find the OpenPGP keys of Mailbox Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Mailbox Mail's own domains, like '@mailbox.org'. If you use a custom domain, you must Tcf362fconfigure WKD separately.

Your account will be set to a restricted user account when your contract ends. It will be irrevocably deleted after 30 days (https://kb.mailbox.org/en/en/private/account/reactivate-a-deleted-account/).

You can access your Mailbox Mail account via IMAP/SMTP using their .onion service (https://kb.mailbox.org/en/en/private/security-privacy/using-the-tor-exit-node-from-mailbox/). However, their webmail interface cannot be accessed via their .onion service, and you may experience TLS certificate errors.

All accounts come with limited cloud storage that can be encrypted (https://kb.mailbox.org/en/private/drive/encrypt-files-on-your-drive/). Mailbox Mail also offers the alias @secure.mailbox.org (https://kb.mailbox.org/en/business/e-mail-article/ensuring-e-mails-are-sent-securely/), which enforces the TLS encryption on the connection between mail servers, otherwise the message will not be sent at all. Mailbox Mail also supports Exchange ActiveSync (https://en.wikipedia.org/wiki/Exchange_ActiveSync) in addition to standard access protocols like IMAP and POP3.

Mailbox Mail has a digital legacy feature for all plans. You can choose whether you want any of your data to be passed to heirs, providing that they apply and provide your testament. Alternatively, you can nominate a person by name and address.

T969389Part 1/2 Tcf362fNext

Tcf362fGuides Home Tcf362fSearch Guides

Tcf362fHome Tcf362fWiki Tcf362fTG Series Tcf362fChat Tcf362fArticles Tcf362fContact

Ta6a49eContent from Privacy Guides (privacyguides.org), commit 0295ab4.

Ta6a49eLicense: CC BY-SA 4.0 - creativecommons.org/licenses/by-sa/4.0