Bobby Wilson
The most private email providers automatically apply end-to-end encryption, so even the provider cannot read the protected message content. Proton Mail and Tuta stand out because this protection is built in between their own users. Mailbox.org, StartMail and Fastmail protect less by default. Posteo is a strong privacy name but sits lower here for reasons explained below.
Quick Overview of the Best Private Email Providers
Proton Mail
Tuta Mail
Mailbox
StartMail
Posteo
Fastmail
What makes an email provider actually private?
A private email provider should collect as little information as practical, avoid advertising based on your inbox and protect your messages against unnecessary access. Encryption matters, but the type of encryption matters more than the word itself.
End-to-end encryption means a message is encrypted on the sender’s device and can only be decrypted by the intended recipient. The provider carries and stores the protected message but does not hold the key needed to read its contents.
Automatic end-to-end encryption is the simplest and strongest model for an ordinary user. It works without asking the sender to create encryption keys, exchange them with the recipient or remember to press an encryption button. Proton Mail and Tuta use this model for messages sent between accounts on their own services.
Optional PGP is different. PGP, which stands for Pretty Good Privacy, can provide end-to-end encryption, but the user normally has to set it up and manage encryption keys. Both people must use compatible software and the sender must encrypt the message correctly. A provider that supports PGP is not automatically end-to-end encrypted.
Encryption at rest is different again. It protects stored data on a provider’s servers, which can help if storage hardware is stolen or improperly accessed. However, the provider may still control the encryption keys or process the readable message on its systems. This is useful security, but it does not make the provider unable to read your email.
No email provider can hide everything needed to deliver a normal email. Sender and recipient addresses must usually remain available for routing. Some providers also leave subject lines outside end-to-end encryption. This ranking therefore looks at what is protected automatically, what remains visible and how much work the user must do.
The best private email providers
These are the providers worth considering, starting with the two that encrypt your mail end-to-end automatically. Proton is my top pick, and Tuta is the other provider that protects your messages by default. The rest each have their strengths, and which suits you depends on what you need.
Proton Mail
Proton Mail is my main email service, and I pay for Proton Unlimited. It is my top pick because it combines meaningful privacy with the best overall interface and user experience of the providers here.
Messages sent from one Proton Mail address to another are automatically end-to-end encrypted. Proton also applies zero-access encryption to stored mail. Zero-access encryption means Proton stores incoming mail in a form that Proton cannot decrypt.
That protection has a clear boundary. A normal email sent from Proton to another provider is not automatically end-to-end encrypted. It is protected in transit using TLS, which encrypts the connection between mail servers, but the receiving provider may still be able to read the message.
When you need stronger protection outside Proton, you can apply password protection to a message or use PGP.
Proton does not end-to-end encrypt email subject lines. It says this is because its system follows the OpenPGP standard, which does not protect that part of an email in the same way. Sender and recipient addresses also remain part of the message information needed for delivery. This limitation matters because a revealing subject line can expose information even when the message body is protected.
The service is operated from Switzerland and is funded by subscriptions rather than advertising or selling access to inbox data. A free plan is available, while custom domains require a paid plan.
Proton is my top pick, and not because its encryption is stronger at every point. Tuta actually protects subject lines and Proton does not. I prefer Proton because it is more polished, easier to use and more practical as a complete everyday service.
It is also part of a wider set of privacy services. Proton Unlimited combines email with Proton VPN, Proton Pass, Proton Drive and other tools under one account. That broader package is useful when you want more than a private inbox, although whether the complete subscription is worth it is a separate question.
Honest limitation: Proton cannot automatically provide end-to-end encryption for ordinary email sent to people using unrelated providers, and its subject lines are not end-to-end encrypted.
Tuta
I also use Tuta. It is genuinely secure, and like Proton it encrypts your mail automatically rather than leaving it to you to set up.
Messages between Tuta users are automatically end-to-end encrypted. Tuta encrypts the message body, attachments and subject line. Its documentation says the unencrypted information is limited to email addresses and the sender and recipient information needed to deliver messages.
Subject-line encryption is Tuta’s clearest advantage over Proton. A subject such as “medical appointment”, “employment contract” or “account problem” can reveal something important before anybody reads the message itself. Tuta protects that field automatically when both people use Tuta.
Tuta can also send an end-to-end encrypted message to somebody outside its service by using a shared password. The recipient opens a protected mailbox through a link rather than receiving a normal readable email in their usual inbox. Without that shared-password method, ordinary email interoperability still creates the same basic limits found elsewhere.
The service operates from Germany. It has a free plan, does not use personalised advertising and supports custom domains on paid plans.
Tuta deliberately does not support IMAP, which is the standard that lets a desktop email app synchronise with a mail server. It requires you to use Tuta’s own web, desktop or mobile apps so its encryption system can remain integrated. It also does not use OpenPGP.
Those choices improve consistency inside Tuta, but they reduce flexibility. You cannot add a Tuta mailbox to a normal IMAP desktop app, and it does not directly interoperate with people who already use PGP. I also find the interface less polished than Proton’s. It is straightforward, but Proton feels more refined for everyday use.
Honest limitation: Tuta’s closed email workflow means no IMAP and no OpenPGP compatibility. It is secure by default, but less flexible and less polished to use.
Mailbox.org
Mailbox.org is a German, subscription-funded provider that pairs email with calendars, cloud storage and online office tools. It is ad-free, supports custom domains, and works with standard desktop apps over IMAP.
Its encryption is capable but optional, which is the key difference from Proton and Tuta. Mailbox.org supports both PGP and S/MIME, and its Guard system brings PGP into the web interface so you do not need separate software. Guard generates and manages your keys on Mailbox.org’s German servers, encrypted under your password, and can even set up a secure guest mailbox for recipients who do not use PGP themselves.
That convenience comes with a trade-off. Because Guard runs on the server, you are trusting Mailbox.org’s systems rather than encrypting only on your own device. For device-level end-to-end encryption you can install the Mailvelope browser plugin instead, which keeps your private key local. Either way, encryption is something you choose and configure, so ordinary mail is not automatically protected from the provider the way Proton-to-Proton or Tuta-to-Tuta mail is.
There is also a limit that applies to all PGP-based systems, including this one. PGP encrypts the message body, not the subject line or the routing details. So even when a message is encrypted, its subject and the sender and recipient information remain visible. Mailbox.org can optionally encrypt incoming mail in your inbox using your public key, though sent mail is not stored encrypted in the same way.
Mailbox.org suits someone who wants a privacy-respecting German provider with custom domains, standard email apps and established encryption standards available when needed. It asks more of the user than Proton or Tuta and protects less by default.
Honest limitation: strong end-to-end encryption depends on you setting up and using PGP or S/MIME, and subject lines and metadata stay visible. Ordinary mail is not automatically encrypted against the provider.
StartMail
StartMail is a paid email service based in the Netherlands. It supports custom domains, disposable aliases and optional encrypted messages. It does not fund the service through inbox advertising.
Its User Vault protects the stored mailbox while the user is logged out. StartMail explains that ordinary unencrypted email becomes available in readable form while the account is open, while PGP-encrypted mail remains encrypted until the user provides the relevant passphrase.
That is meaningful protection for stored data, but it is not the same as automatic end-to-end encryption. StartMail offers one-click PGP tools and password-protected messages for recipients who do not use PGP. The sender still has to choose the protected method.
StartMail also states that email subject lines cannot be encrypted when a message is sent over the internet. A protected message may therefore conceal its body while leaving the subject visible. Its accessible documentation did not provide a complete field-by-field account of other routing metadata, so broader claims should be avoided.
StartMail’s main attraction is the combination of conventional email features and privacy tools. Disposable aliases can keep a main address away from shops, newsletters and online accounts. Standard email support also gives it more flexibility than Tuta.
It ranks below Mailbox.org here because neither service provides automatic end-to-end encryption, while Mailbox.org documents a broader set of PGP, S/MIME and mailbox-encryption controls. The exact order between them matters less than the tier. Both require deliberate action from the user.
Honest limitation: The encrypted User Vault protects stored mail while logged out, but ordinary messages are not automatically end-to-end encrypted and subject lines remain outside the protected message.
Posteo
Posteo is a long-established German provider built around one idea: storing as little about you as possible. It takes no personal details when you sign up, keeps no logs tied to your account, and keeps its payment records separate from your mailbox. It is ad-free and funded entirely by its users.
Its most distinctive choice is that it deliberately does not let you use your own custom domain. For portability that is a real limitation, but the reason is a genuine privacy stance. Posteo runs on what it calls data economy: a custom domain would require it to store the personal information a domain registration carries, so it refuses to offer the feature and keeps nothing to hand over if authorities ask. You choose from Posteo’s own domain endings instead, such as posteo.net, posteo.uk or posteo.eu. Posteo is also exempt from Germany’s data-retention rules, because email providers are excluded from that law.
On encryption, Posteo is honest about what it does and does not do, and it is important to be precise. Ordinary Posteo email is not automatically end-to-end encrypted. It is protected by TLS while travelling, and Posteo receives the readable message on its servers. What Posteo adds is unusually strong optional protection: its crypto mail storage feature encrypts your stored mailbox so that Posteo itself can no longer read it, with your password holding the key. It also supports inbound encryption using your PGP or S/MIME key, and full PGP or S/MIME for genuine end-to-end encryption if you set it up.
That places Posteo above a conventional provider like Fastmail on stored-privacy, because its crypto mail storage can make your mailbox unreadable to Posteo, but below Proton and Tuta, which encrypt automatically between their own users without any setup. Posteo is a traditional, standards-based email service with unusually strong privacy and optional encrypted storage, rather than an automatically encrypted system.
Honest limitation: no custom domains by design, and ordinary mail is not automatically end-to-end encrypted. Its strongest protection needs you to switch on crypto mail storage or configure PGP yourself.
Fastmail
Fastmail is a well-designed, paid email service operated by an Australian company. It supports custom domains, standard email apps and Masked Email, which creates separate addresses that can hide your main address from websites.
It is private in the business-model sense. Fastmail says it does not mine personal data and does not show advertising. It also encrypts data in transit and on its storage systems.
It is not private in the provider-blind sense used at the top of this ranking. Fastmail explicitly says that its own apps do not offer end-to-end encryption. Users who need PGP or S/MIME can use those systems through compatible third-party apps, but the protection is not built into the Fastmail experience.
Fastmail’s systems need access to readable data to provide functions such as full-text search, message previews, spam filtering and notifications. It also controls the keys used for its storage encryption. Encryption at rest therefore protects the infrastructure without preventing Fastmail from processing ordinary messages.
This does not make Fastmail a bad email service. Its speed, standards support, search and custom-domain tools can make it a strong conventional email provider. It ranks last because the question here is which service keeps message contents away from the provider, not which one offers the smoothest standard email experience.
Fastmail’s reputation can become misleading when “private” is treated as a synonym for “end-to-end encrypted”. It is ad-free and does not rely on data mining, but it does not provide the automatic provider-blind encryption that puts Proton and Tuta at the top.
Honest limitation: Fastmail has no built-in end-to-end encryption. The provider can process ordinary message contents to run the service.
How the providers compare
Encryption is the column that matters most. Automatic end-to-end encryption means the provider cannot read your messages by default. Optional PGP means you can encrypt, but only if you set it up. No built-in encryption means the provider can read ordinary mail.
| Provider | Encryption | Free plan | Custom domains | Best for |
|---|---|---|---|---|
| Proton Mail | Automatic end-to-end (Proton to Proton) | Yes | Paid plans | The best all-round private email |
| Tuta | Automatic end-to-end, incl. subject lines | Yes | Paid plans | Maximum secure-by-default |
| Mailbox.org | Optional PGP / S-MIME | No (trial) | Yes | A privacy-respecting German provider |
| StartMail | Optional PGP, encrypted vault at rest | No (trial) | Yes | Aliases and flexible standard email |
| Posteo | Encryption at rest, optional PGP (not automatic) | No | No, by design | A data-minimal German provider |
| Fastmail | None built in | No (trial) | Yes | Excellent conventional email, not privacy |
Which should you choose?
Proton Mail is the best all-round choice for most people who want a private email provider. It automatically protects messages between Proton users, has a polished interface and works as part of a larger privacy ecosystem. Its main encryption weakness is the unprotected subject line.
Tuta is the stronger choice when secure-by-default communication matters more than flexibility. It automatically protects subject lines as well as message bodies and attachments between Tuta users. The trade-off is a less refined interface and no IMAP or OpenPGP support.
The practical choice between the two comes down to priorities. Proton offers the better complete product and ecosystem. Tuta protects more of an encrypted email’s visible content. A closer Proton and Tuta comparison helps when that difference is the deciding one.
Mailbox.org is suited to people who want standard email clients, custom domains and optional PGP or S/MIME tools. StartMail is worth considering for aliases, custom domains and user-selected encrypted messages. Both are privacy-respecting services, but neither gives ordinary users the same automatic end-to-end protection as Proton or Tuta.
Posteo should remain a cautious option until its current official documentation can be checked directly. Fastmail suits people who value excellent conventional email and an ad-free business model, but it is not the right choice when the provider itself must be unable to read ordinary messages.
Secure email is not a single feature. The important question is what happens before you press send. Proton and Tuta protect messages between their own users automatically. The other providers can still respect privacy, but their strongest encryption either needs manual action or does not prevent provider access at all.