We don’t know exactly what he said, but in 1971, Ray Tomlinson used Arpanet to send the first email ever. You can bet he was only thinking about getting the message to its destination, not about securing it against snooping. But once businesses started using email, privacy became a necessity. We at PCMag have been covering email encryption utilities since the mid-90s. If you want actual privacy in the form of email messages that only the recipient can read, you need an encrypted email service. With PreVeil, you get industrial-grade encryption at no cost. You can use Proton Mail for free, too, with some limitations, but paying customers receive a wealth of additional benefits. These two are our Editors’ Choice winners, but all of our favorites are listed below, so read on to find the right service for you.
Overview
-
Jump To Details
![Proton Mail]()
Best Bonus AppsProton Mail
-
Jump To Details
![PreVeil]()
Best for Free EncryptionPreVeil
-
Jump To Details
![SecureMyEmail]()
Best for Encrypting Existing AccountsSecureMyEmail
-
Jump To Details
![StartMail]()
Best for Disposable Email AddressesStartMail
-
Jump To Details
![Virtru for Google Gmail]()
Best for Gmail EncryptionVirtru for Google Gmail
-
Jump To Details
![Tuta Mail]()
Best for Ease of UseTuta Mail
-
Jump To Details
![Private-Mail]()
Best for Secure File SharingPrivate-Mail
You Can Trust Our Reviews
Deeper Dive: Our Top Tested Picks
-
![Proton Mail]()
Best Bonus AppsProton Mail
Pros & Cons
If the name Proton Mail rings a bell, it’s probably because you know about , a five-star PCMag Editors’ Choice winner in the realm. Springing for a top-tier paid subscription to Proton Mail also gets you Proton VPN, as well as Proton's calendar, cloud storage, and password management apps. On the flip side, you can save a bundle by accepting the limitations of Proton Mail’s free account tier. You will need to switch to a new Proton Mail email address, but doing so is an opportunity to eliminate the spam and unwanted mail cluttering your old address. Communication with other Proton Mail accounts is end-to-end encrypted; communication with outsiders uses a password that you transmit via a separate cover.
Proton VPNVPNWhy We Picked It
Pricing and compatibility: To use Proton Mail, you must switch to a new email address at one of Proton’s domains, unless you bring your own custom domain with you. You can create your account and give it a try at no charge, though the free tier limits your online storage and caps usage at 150 messages per day. If you find that you like the free app but chafe at its limitations, you can upgrade to the Plus edition for $47.88 per year. If you step up to the Unlimited level, you pay $119.99 per year. Don’t faint; that price gets you full access to all of Proton’s products, including calendar, online storage, password management, VPN, and even a bitcoin wallet manager.
Authentication and security: There’s not much point in encrypting your email messages if a hacker can peek at them. Your Proton Mail account is protected by a master password, but you’ll also want to enable multi-factor authentication using Google Authenticator or a compatible authenticator app. Once you’ve enabled the authenticator app, you can take one more step toward impenetrable email security by enabling authentication using a hardware security key.
Encryption type: Some email encryption tools rely on PGP (Pretty Good Privacy) for their encryption, which, in theory, lets them share messages with other apps that use PGP. Setting up PGP can be awkward, though, so other apps trust their own proprietary encryption. Proton Mail uses PGP to protect your conversations with other Proton users. When you want to send secure mail to a non-user, Proton relies on an internal encryption algorithm that assigns a password (and optional hint) to each message. Naturally, you share the password through some other service, perhaps an encrypted messaging app on your phone.
Temporary email aliases: While Proton Mail encrypts the contents of your email conversations, these messages still visibly appear to come from your email address. That means scammers and spammers might obtain that address, to your detriment. Proton Mail subscribers can take advantage of "hide-my-email" aliases supplied with Proton Pass—10 aliases for free users, unlimited for paying customers. At the Ultimate subscription tier, though, you get access to the SimpleLogin temporary email address service. Using Proton Mail and SimpleLogin together means you’re protecting the contents of your messages and also masking your actual email address.
Advanced features: If you spring for the most expensive subscription tier, you get the whole collection of Proton apps, including password management, VPN, and more. Standard and free subscribers also have access to these apps, albeit with limitations. Even at the free tier, you get 500MB of online shareable file storage. That rises to 15GB for paying customers, or 500GB for Ultimate users. You can set an expiry date for messages to non-Proton users. To organize your messages, you can put them in folders, apply labels, or both. Other features include defining message filter rules, setting an out-of-office message, and managing encrypted calendars. With Proton Mail, you get a lot more than just encryption.
Who It’s For
Curious newbies: You know that encrypting your email would be smart, but you worry it might be too intrusive. No problem—just start a free Proton Mail account and give it a whirl. By the time you bump up against limits like 150 messages a day, you’ll know if you want to upgrade to a paid account.
Mobile mavens: Sit at a desk, with a desktop computer? Nope. You’re on the go, working from your mobile device. Proton Mail offers full-powered apps for Android and iOS, so you can use it wherever you go.
Feature collectors: When you choose an app, you want the maximum bang for your buck. With Proton Mail’s most expensive tier, you get full access to Proton’s VPN, password manager, cloud storage, and more. Standard and free tiers still get a subset of those features, decidedly more than you get with the competition.
Specs & Configurations
Cloud Storage and File Sharing Disposable Email Addresses Non-PGP Encryption PGP Encryption Supports Rich Text Messages Two-Factor Authentication Learn More Proton Mail Review -
-
![PreVeil]()
Best for Free EncryptionPreVeil
Pros & Cons
It seems logical that businesses would use encryption systems that are more powerful and technical than what’s available for consumers. It also seems logical that if consumers did get business-grade encryption, it would cost a lot. Preveil turns both of those assumptions on their head. Its powerful technology is certified by the Department of Defense, and its price is zero. Yep, it’s free. Switching to encrypted email often involves getting used to a new email address, but Preveil lets you keep your existing address. It doesn’t demand a master password; your trusted device authenticates you. If you lose all your trusted devices, a high-tech multi-person recovery system helps you regain access to your account. With Preveil, you also get 5GB of encrypted file storage, and you can share your secure files with other Preveil users at four permission levels.
Why We Picked It
Pricing and compatibility: Getting started with PreVeil could hardly be easier. You don’t have to worry about the price, as it’s free. You don’t have to switch to a new and different email address. And PreVeil integrates with Apple Mail, Gmail, and Outlook. Easy!
Authentication and security: As noted, with PreVeil, you simply continue using your existing email account, and PreVeil assumes that you maintain its security. You don’t have to remember a master password or set up an authenticator app for PreVeil. However, if you haven’t set up multi-factor authentication for your email account, now would be a good time to do so.
Encryption type: Different email encryption systems that rely on the same Pretty Good Privacy (PGP) algorithm for encryption can theoretically share messages. In practice, setting up PGP on a single system can be challenging, and sharing the necessary public and private keys may be too complicated for some users. PreVeil eschews that shared technology, relying instead on an elaborate system of “wrapped keys” to thoroughly protect encryption details while keeping the user blissfully unaware.
Temporary email aliases: Some email encryption systems also handle hiding your actual email address behind temporary addresses, one for each correspondent. PreVeil doesn’t attempt that feat. If you want to hide your email address, you can pick up a free temporary email service like Bulc Club or ManyMe.
Advanced features: Paralleling its high-tech encryption technology, PreVeil comes with a business-grade account recovery system that uses partial keys held by multiple friends or colleagues. You can securely store important files in your 5GB of cloud storage and securely share those files, with detailed control over the recipient’s access permissions.
Who It’s For
Freebie chasers: You didn’t get rich by paying for things you can have for free. When an app is both free and high-powered, like PreVeil, you’re delighted.
Change resisters: Thousands of people know and use your email, so the last thing you want is to try getting all of them to connect with you over a different address. Since PreVeil works with your existing email, there’s no worry about changing.
Mobile mavens: You’re just as likely to check email on your phone as you are to sit down at a Mac or a Windows PC. Your encryption solution needs to thoroughly support mobile platforms. You’ll find PreVeil as a free download in both the Google Play Store and the Apple App Store.
Specs & Configurations
Cloud Storage and File Sharing Non-PGP Encryption Supports Rich Text Messages Two-Factor Authentication Works With Existing Email Learn More PreVeil Review -
-
![SecureMyEmail]()
Best for Encrypting Existing AccountsSecureMyEmail
Pros & Cons
Starting with email encryption often entails switching to a new email address, which can be a deal-breaker for some. With SecureMyEmail, you can keep your prized email account and still secure your communications, as long as that account supports IMAP. And if it’s a Gmail, Yahoo, or Microsoft account, there’s no charge to use SecureMyEmail. Paying customers can protect up to eight email accounts. SecureMyEmail relies on PGP for encryption, but hides most of this technology’s complications. Sending encrypted messages couldn’t be easier, regardless of whether the recipients are SecureMyEmail users, non-users, or a mix. The service encrypts mail for non-users relying on a key pair that it generates based on the recipient’s email address. As with Virtru, the recipient doesn’t need a password.
Why We Picked It
Pricing and compatibility: With some email encryption services, you may need to switch to a new email account managed by the service. Not SecureMyEmail. You can start with a free installation that protects one existing email account. If you decide to unlock all features by switching to a paid account, you can protect up to eight existing accounts. And all that protection comes at a cost of $29.99 per year.
Authentication and security: SecureMyEmail protects your sensitive, encrypted email with multiple security layers. First, of course, there’s the security of your email account itself. You’re using a strong password, right? You also lock down your SecureMyEmail account with its own password. A separate passphrase secures the public and private encryption keys that the program generates. Additionally, you can enable multi-factor authentication using Google Authenticator or a compatible authenticator app. If you send a secure message to someone who doesn’t use PreVeil, they get an invitation to sign up. After all, it’s free.
Encryption type: The Pretty Good Privacy (PGP) encryption system has been around for more than 30 years, and it remains secure if developers make informed component choices. SecureMyEmail hides the initial PGP setup process as much as possible. In theory, you can exchange secure messages with users of different encryption apps, as long as they also use PGP. In practice, it’s complicated. For recipients who don’t use PGP, SecureMyEmail can encrypt a message based on the recipient’s email. A more thorough (but less convenient) option is to encrypt the message using a password that you share with the recipient via another channel.
Temporary email aliases: Every time you send an email, there’s a chance your email address might be exposed, either in a breach or because the recipient sold you out. Some email encryption apps incorporate privacy protection by hiding your actual address behind a host of disposable, temporary addresses. SecureMyEmail isn’t in that group, so if you want to conduct your email conversations without actually revealing your true address, you’ll need a separate temporary email app.
Advanced features: In addition to encrypting your messages, SecureMyEmail allows you to digitally sign them, ensuring that the recipient knows that the message originated from you and has not been tampered with. It also maintains a secure contacts list. As with Proton Mail, you can set an expiry date for messages sent to recipients who don’t use SecureMyEmail.
Who It’s For
Cautious newbies: Before signing up for a new service, you like to know what you’re getting into. You can use SecureMyEmail for 30 days before paying for it, and you don’t even have to register a credit card.
Change resisters: You’ve considered using email encryption, but were put off by the need to uproot your stability and switch to a completely different email address. SecureMyEmail allays those worries because you use it with your existing email address. No change needed.
Mobile mavens: Sure, a computer with a keyboard is handy when you’re composing a lengthy email screed, but for just checking messages and making quick replies, a smartphone or tablet can be more convenient. SecureMyEmail is fully functional on both Android and iOS, and even features an iPadOS edition that leverages the larger screen.
Specs & Configurations
PGP Encryption Supports Rich Text Messages Two-Factor Authentication Works With Existing Email Learn More SecureMyEmail Review -
-
![StartMail]()
Best for Disposable Email AddressesStartMail
Pros & Cons
Encrypting your email ensures that no one can view or modify your confidential communications with trusted correspondents. Using temporary email addresses, also known as disposable email addresses (DEAs), allows you to communicate with untrusted recipients without sharing your actual email address. In a pleasant synergy, StartMail offers both. Any time you have to supply an email address for a newsletter, a new online merchant, or other nonpersonal connection, you can spin up an email alias in StartMail. Messages to the alias appear in your inbox, and replies seem to come from the alias. However, if you want to sever the connection, perhaps because it has begun receiving spam, you can simply disable or delete the alias.
Why We Picked It
Pricing and compatibility: You do have to switch to a new email address if you want to use StartMail, but look on the bright side—you’re leaving behind all the spam and detritus associated with your existing account. StartMail doesn’t offer a limited, always-free tier, but you can try it out for seven days before committing to the $59.88 annual subscription.
Authentication and security: When you fire up a new StartMail account, you create a password to protect all your messages. Make it strong, or StartMail will gripe. To make sure you don’t lose access to your messages, StartMail generates a recovery code that you can use if you forget your password. Of course, a hacker or snooper who obtains your password or recovery code can access all your secrets. To avoid that unwelcome outcome, StartMail supports multi-factor authentication using Google Authenticator (or another app that supports standard Time-based One-Time Password (TOTP) authentication).
Encryption type: The PGP (Pretty Good Privacy) encryption system operates by generating pairs of keys, one public and one private. A message encrypted with your public key can only be decrypted using the private key. Setting up those key pairs can be a pain, but StartMail automates the process. It’s theoretically possible to export your keys and share them with others, enabling secure email even with those who don’t use StartMail, but it’s a complicated process. Most users will stick to StartMail’s password-based system for securely emailing contacts outside the StartMail network.
Temporary email aliases: Encryption lets you securely exchange messages with trusted correspondents. StartMail also provides a different kind of security for messaging with online merchants and others not in your inner trust circle. It can create an email alias for every such correspondent. The recipient sees that alias and never learns your actual email address. You send and receive messages as usual, but if one of your aliases starts getting spam, you can just trash it.
Advanced features: Messages sent to you get encrypted using your public PGP key, and StartMail decrypts them using your private key. You can also flip that scenario, digitally signing a message by encrypting it with your private key. The fact that your public key decrypts the message proves that it came from you, with no modifications. There’s an option to define message filters, primarily for slotting incoming mail into folders. And, as noted above, StartMail includes full email alias support.
Who It’s For
Feature collectors: Given two apps that perform their stated task equally well, you’ll always choose the one that has more features beyond that stated task. StartMail’s big bonus is a full-powered temporary email service, hiding your actual email when you communicate with merchants and other less-trusted sources. It beats out the limited email alias systems found in several competitors.
Specs & Configurations
Disposable Email Addresses Email Encryption Multi-Factor Authentication Non-PGP Encryption Online Mailbox PGP Encryption Reply From Alias Supports Rich Text Messages Two-Factor Authentication Learn More StartMail Review -
-
![Virtru for Google Gmail]()
Best for Gmail EncryptionVirtru for Google Gmail
Pros & Cons
Like Preveil, Virtru brings business-grade encryption to the consumer level without charging a penny. Just install the Virtru extension in Chrome, log in to your Gmail account, and activate the encryption service. There isn’t a separate password or login for Virtru—it’s protected by your strong Gmail account password and your Gmail two-factor authentication. When you send a message using Virtru, you have more control than just turning on encryption. You can set the message to expire after a specified time, and you can also control message expiry for sent messages. The recipient doesn’t need a password to open your secure message, but nobody else can open it without proving ownership of the receiving email address. You can also put limits on replying and forwarding through the secure portal.
Why We Picked It
Pricing and compatibility: Adding encryption to your email account with Virtru is a snap, provided that your account is with Gmail and you access your mail using Chrome. You can keep your existing email address, and you won’t have to pay a penny.
Authentication and security: Virtru integrates seamlessly with Gmail and relies on Gmail's security features. You’ve enabled multi-factor authentication for your Gmail account, right? Anyone who gains access to your Gmail can also see your encrypted messages, so keep that Gmail account tight.
Encryption type: Some email encryption services rely on the venerable PGP (Pretty Good Privacy) algorithm for their encryption. Virtru bypasses the potential speed bumps associated with setting up PGP, relying on its own proprietary encryption system. Messages with other Virtru users are encrypted and decrypted seamlessly. If you send a secure message to a non-user, they receive a link that allows them to view and respond to the message online. There’s no password required, but only the owner of the receiving email account can open the message.
Temporary email aliases: Encrypting your mail prevents snooping of message contents, but the fact that you sent the message remains plainly visible. Some of Virtru’s competitors enhance their privacy protection by integrating a temporary email address system, so the recipient never sees your actual email address. That’s not something Virtru does, though you can use it alongside a free temporary email service.
Advanced features: Virtru’s strength lies in its simplicity. Install the extension in Chrome, and it handles securing your Gmail account. It doesn’t add unnecessary features. It does have the handy ability to set an expiry time for any message or even revoke access to messages you’ve already sent. And the clever Rules system gives you special insight into messages that contain sensitive personal information, letting you automatically encrypt such messages, display a warning, or actively prevent sending, say, your SSN.
Who It’s For
Freebie chasers: Why pay for something you can get at no cost? You like a bargain price, but you like getting freebies even better. Virtru doesn’t cost a thing, making it the perfect choice for you.
Change resisters: Encrypting your email is smart, but you balk at having to create, remember, and share an entirely new email address. Virtru has you covered—it totally works with your existing Gmail.
Minimalists: You’re willing to invest the effort to secure your email with encryption, but you have no interest in complex setup processes, such as activating PGP encryption keys. With Virtu, you install a Chrome extension and can start using encryption immediately. Now that’s simple.
Specs & Configurations
Non-PGP Encryption Supports Rich Text Messages Works With Existing Email Learn More Virtru for Google Gmail Review -
-
![Tuta Mail]()
Best for Ease of UseTuta Mail
Pros & Cons
If you mailed a ciphertext letter to a known criminal, the return address on the envelope might still incriminate you. Tuta Mail uses open-source encryption on the body text, message headers, and subjects of your messages. It even encrypts your contacts when you’re not actively using them. Its free tier allows unlimited messages, and its paid tier is less expensive than many. Tuta Mail creates a secure, encrypted index on your local device, allowing you to search your messages without compromising security. Paying customers receive unlimited searching, while free users are limited to searching within the previous 30 days. Like Proton Mail, it includes an encrypted calendar. Its Filter system lets you automatically organize messages based on content or header info. And its mobile apps give you full access to all features.
Why We Picked It
Pricing and compatibility: You can install Tuta Mail and start using some of its features at no cost, except for the effort required to switch to a new email account. If the free tier does all you need, you’re golden. And if you decide you want more, the subscription price isn’t outrageous, just 36 euros. As of this writing, that’s just a bit over $42.
Authentication and security: Like StartMail, Tuta Mail requires you to define a master password when creating your account. Also, like StartMail, it provides a recovery code that you can use if you forget your password. But that password or recovery code works just as well to let a data thief into your encrypted email store. To eliminate that danger, you should configure Tuta Mail to use multi-factor authentication. As is typical, it supports the Google Authenticator app as well as any compatible authenticator apps. Once you’ve done that, you can configure Tuta Mail to use a hardware security key with the authenticator app as backup in case you lose your key.
Encryption type: The popular Pretty Good Privacy (PGP) algorithm relies on pairs of public and private keys. Anyone can send you a message encrypted with your public key, but only you can decrypt it with your private key. Internally, Tuta Mail uses public and private keys, but in its own way, not through PGP. That means you can’t hook up private communications with users of other encrypted email systems that rely on PGP, but then, few consumers have the skill to set up that connection. Messaging with non-users relies on password-based encryption, but Tuta Mail cleverly stores a password along with each of your contacts. As always, you transmit the password using an alternative communication path, such as an encrypted mobile messaging app.
Temporary email aliases: By using a temporary email address service, you can communicate via email without revealing your true email address. The service handles managing all those email aliases, so you can read and respond to messages without any additional effort. Tuta Mail does include a feature it calls email aliases, but it’s limited. You can have a maximum of 15 aliases, but there is no option to change them once they are selected. And there’s no management of aliases like a true temporary email service would include. Tuta Mail’s aliases are more suited as a tool to organize your messages.
Advanced features: Like Proton Mail and Private-Mail, Tuta Mail includes an encrypted calendar with all the expected features, such as repeating appointments, all-day events, and secure invitations. You can use its inbox rules system to sort incoming mail into folders based on words in the subject or people in the recipients list.
Who It’s For
Cautious newbies: You’re willing to consider spinning up a brand-new email account for encrypted messaging, but you’re not entirely sure it will suit you. Tuta Mail’s free subscription is just the thing for you. Now you can enjoy the full experience for as long as you need to decide whether to upgrade to a paid subscription.
Mobile mavens: You use a wide range of devices, including desktop computers running various operating systems and mobile devices that run Android or iOS. Tuta Mail can run entirely within the browser, allowing you to use it on any desktop platform. And its Android and iOS apps include all the same features.
Specs & Configurations
Non-PGP Encryption PGP Encryption Supports Rich Text Messages Two-Factor Authentication Learn More Tuta Mail Review -
-
![Private-Mail]()
Best for Secure File SharingPrivate-Mail
Pros & Cons
Private-Mail comes from the same crew that brings you . If you’re willing to accept a few limitations, you can use its encrypted email and file-sharing system for free. Paying for the Standard edition increases your email and file storage from 100MB to 10GB each and adds features, including a secure calendar and syncing mail between devices. The Pro edition doubles both the price and the storage. You can encrypt or digitally sign your Private-Mail messages using PGP once you have exchanged PGP keys with your contacts. After you configure a separate set of PGP keys for encrypted files, putting a file into encrypted storage is as simple as dropping it into the Encrypted folder. You can share files from storage with others using PGP, or you can choose to share using a password that you send separately.
TorGuard VPNWhy We Picked It
Pricing and compatibility: At $69.99 per year, Private-Mail is more expensive than some competitors and less expensive than others. But you don’t have to shell out for a subscription right away. You can create a free account with all the same encryption technology, but it is limited in the amount of online storage devoted to your messages and files. As with many similar services, you must create a new, secure email address to make use of Private-Mail’s services.
Authentication and security: When setting up a new Private-Mail account, you select your new email address and provide a recovery email, a credit card number (even for free installations), and a password to secure your account. Even the strongest password can be vulnerable to hacking or shoulder surfing, though. For full protection, you should enable multi-factor authentication. All it takes is the Google Authenticator app on your phone, or any compatible authenticator app.
Encryption type: In its more than three decades of existence, the PGP (Pretty Good Privacy) encryption algorithm has supported a vast number of apps. Private-Mail relies on PGP, though its setup process is more awkward than most. You’ll need to figure it out because you can’t use the app without configuring PGP.
Temporary email aliases: Encryption keeps what’s in your email messages private. Using temporary email addresses provides a layer of privacy protection for your email address. The service manages email aliases, typically a different one for each correspondent. Private-Mail has a feature called email identities that’s similar, but limited. You get a fixed number of identities, five by default, so the idea of using a separate one for each correspondent goes out the window.
Advanced features: One surprising absence with Private-Mail is that the OpenPGP protocol strips out all formatting from encrypted messages. All the other apps fully support rich text messaging. On the plus side, Private-Mail enhances your messaging with an encrypted calendar and the option to define message filter rules. The app offers 10GB of storage for encrypted files, along with secure file sharing. Setting up file encryption is awkward and involves configuring a separate set of PGP keys.
Who It’s For
Cautious newbies: Before opening your wallet to buy a new app or service, you like to take it for a test drive first. That’s easy with Private-Mail; you can start with a free account and see how it goes. A free account gets less online storage for files and messages, but by the time you outgrow those limits, you should be clear about whether you want to stick with Private-Mail.
Feature collectors: If you’re going to replace your email address and email client to get the security of encrypted messaging, you want that client to do all the things around email as well. Private-Mail provides an encrypted calendar to complement your encrypted email. Like all the best email clients, it lets you organize messages using message filter rules and set an away message for when you’re out of the office. Private-Mail also provides hosted online storage for encrypted files, allowing you to share them either by using PGP or by setting an encryption password.
Learn More Private-Mail Review -
Compare Specs
Our Pick | ||||||||||
Rating |
4.5 Outstanding |
4.5 Outstanding |
4.0 Excellent |
4.0 Excellent |
4.0 Excellent |
4.0 Excellent |
3.5 Good |
4.5 Outstanding |
4.5 Outstanding |
4.0 Excellent |
Best For | Best Bonus Apps | Best for Free Encryption | Best for Encrypting Existing Accounts | Best for Disposable Email Addresses | Best for Gmail Encryption | Best for Ease of Use | Best for Secure File Sharing | Best Bonus Apps | Best for Free Encryption | Best for Encrypting Existing Accounts |
Works With Existing Email | ||||||||||
PGP Encryption | ||||||||||
Non-PGP Encryption | ||||||||||
Two-Factor Authentication | ||||||||||
Cloud Storage and File Sharing | ||||||||||
Disposable Email Addresses | ||||||||||
Supports Rich Text Messages |
Buying Guide: The Best Email Encryption Services for 2026
Wait, Isn't My Email Already Encrypted?
You may recall that several years ago, Google updated Gmail to always use a secure HTTPS connection. That means it uses the standard Transport Layer Security (TLS) for encryption. This is good, but it’s the bare minimum. Every website should use HTTPS.
Currently, Google says it doesn't read your mail. However, it's easy to accidentally give mail-reading permission to third-party apps. And Google does read your messages sufficiently to automatically add airline flight notifications to your calendar. Google also has a policy explaining when it will release your email to government entities, one that clearly indicates that it can do so if compelled.
Apple Mail supports full-on encryption and digital signatures. To enable these features, you must obtain a security certificate. There were once many sources for free certificates, but the list is shrinking. With the certificate installed in your keychain, your emails are digitally signed by default. If all the recipients of a message also have certificates, you can click the lock icon to send the message encrypted.
The point here is that your email provider’s goals aren’t centered on security and privacy. If you truly want to protect your emails from prying eyes, consider a third-party company that prioritizes security.
What Is the Best Free Email Encryption Service?
Maybe you’re convinced that encrypting your email is good, but are you convinced enough to pay for it with your hard-earned cash? Don’t worry: You don’t have to pay.
Preveil and Virtru are totally free. Both are simplified, consumer-focused editions of enterprise-level products, which is where the companies behind them generate revenue.
You don't have to pay for SecureMyEmail if you use it to encrypt a single Gmail, Yahoo, or Microsoft account, and there are no limits on features. A paid account lets you protect multiple accounts—up to eight—and also adds support for other email providers. Signing up for a free account or a 30-day trial of the paid service doesn't require a credit card or any personal info beyond your email address.
At the free level, Tuta Mail lets you send and receive unlimited messages that are completely encrypted using open-source technology. You even get a secure calendar to go with your secure inbox. Upgrading to the premium edition allows you to create multiple calendars, define up to five aliases (alternate email addresses), and set filter rules to manage incoming messages.
You can also use Proton Mail and Private-Mail for free, but you must accept certain limitations. Smart consumers will set up a free account and see if the limitations are a problem. If they are, converting to a paid account is simple. StartMail is the only product covered here that doesn’t offer a free tier, although it does provide a 7-day free trial.
Do I Have to Change My Email Address for Encryption?
On the one hand, starting fresh with a never-before-seen email address can be freeing. You know that the new address hasn’t been bandied about on the dark web or hoovered up by data aggregators. On the other hand, you must notify all your contacts that your address has changed and update all your online accounts to reflect the new address.
ProtonMail, Private-Mail, StartMail, and TutaMail require you to switch to a new email address (unless you use a custom domain, in which case many will allow you to bring it with you). As with any other webmail system, it must be unique within the system. But since these services don’t have the millions or even billions of users that Gmail or Yahoo do, you may be able to get your own name without tagging on a bunch of numbers or other characters. Wouldn’t you rather have a janedoe@ address than a janedoe18592@ one?
With Preveil, SecureMyEmail, and Virtru, you keep your existing email. In fact, Virtru requires that you use a Gmail address. Preveil doesn’t limit you to any specific email provider. It integrates with Gmail and Outlook on Windows, Apple Mail on macOS, and the native mail app on your mobile devices. Likewise, SecureMyEmail can handle accounts from any email provider that supports IMAP.
Who Can I Email With Encryption?
Encrypting your messages is of no use unless the recipient can decrypt them. Different products handle that aspect in various ways.
The recipient of a Preveil message must install Preveil to read it, period. However, since the product is free and easy to install, that’s not a significant limitation. Your communication is secured with military-level encryption, but you don’t have to remember passwords or take any additional steps beyond choosing to encrypt the message.
Virtru also manages encryption keys without requiring user intervention. The recipient of a Virtru message clicks a link to view and reply to the message in a browser window without needing to install Virtru.
When you send a message to someone outside the Tuta Mail network, the recipient receives a notification with a link, similar to Virtru. You must transmit a password to the recipient by some means other than email. The link opens what's effectively a stripped-down Tuta Mail, with the ability to send secure replies but not much else.
StartMail, Private-Mail, and Proton Mail all use the Pretty Good Privacy (PGP) encryption system to secure messages between users of their respective services. That means they can also exchange encrypted mail with users of other email systems that support PGP. Setting up the necessary key exchange to enable third-party PGP messaging can be difficult, though.
Those same three products also include a provision for securely communicating with those who don’t use the service and don’t have a PGP key. Although the implementations differ, the overall approach remains the same. You encrypt your message with a password and transmit the password to the recipient using a text, a phone call, or other non-email communication.
When you send out-of-network mail from SecureMyEmail, it automatically generates keys and sets the message to expire after 30 days. After authenticating, the recipient views the message on a web page with the option to reply securely. You can shorten the expiry time or add a password for protection. SecureMyEmail can also import existing PGP keys and has no problem with a mix of in-network and out-of-network recipients of the same message.
How Does Encryption Protect My Email?
Using PGP encryption requires that you enter the PGP passphrase for your encryption key. When you send non-PGP-encrypted messages, each can have its own password. Preveil and Virtru don’t require a password—possessing a trusted device is enough for basic authentication. And, yes, you can revoke trust for a lost device.
Tuta Mail encrypts everything, including message headers, subject lines, and contacts. You do use a password to log into your account, so make it a strong one. As noted, communicating with contacts who aren't already using Tuta Mail requires creating a password for each contact and transmitting it by a channel other than email. Tuta Mail securely stores that password along with the contact record.
Whether basic authentication relies on a password or a trusted device, you can crank up security by enabling multi-factor authentication when available. Proton Mail, Private-Mail, StartMail, and Tuta Mail all support multi-factor authentication using Google Authenticator or any authenticator app that can provide a standard time-based one-time password (TOTP).
Tuta Mail also supports authentication using a YubiKey or other security key. You can register multiple keys and even use U2F along with a TOTP app. If you don't have your U2F key available, authentication will roll over to the TOTP app.
With Preveil, you need access to a trusted device (something you have), the password for your email account (something you know), and whatever authentication method you use to open the trusted device, typically a passcode or biometric system. It’s a form of multi-factor authentication, though not the traditional password-plus-TOTP type.
What Else Do I Get With Email Encryption Services?
With some services, you start fresh with a brand-new email address. But once you start using that address, once many different merchants and websites have it, it won’t stay pristine—unless you never share your email address with anyone.
How can you email without giving away your address? By using a temporary email address service, also called a disposable email address (DEA) service, that’s how. Such a service generates a one-time alias whenever you need to share your address. Messages sent to that alias appear in your regular inbox, and replies seem to originate from the alias. And if one of your DEAs starts to receive spam or other issues, you can simply delete it.
Private-Mail can manage DEAs, but it's rather limited compared with dedicated DEA utilities such as Burner Mail and ManyMe. Email aliases in Tuta Mail are even more limited, as you receive only a handful and can't change them after creation. StartMail used to suffer similar limitations, but now offers full DEA management alongside its email encryption. IronVest goes beyond mere DEAs, letting you shop while hiding not only your real email address but also your credit card number and phone number.
Those who choose a Proton Mail Unlimited tier subscription have two ways to access temporary email addresses. The Proton Pass password manager can create and manage what it calls "hide-my-email aliases," for one. Additionally, the Unlimited subscription provides you with full access to the SimpleLogin temporary email service.
With most of these services, you can share a file securely by attaching it to an encrypted message; Private-Mail is the exception, as it supports only plain text. It makes up for that lack by providing encrypted cloud storage, along with the ability to securely share files from your encrypted storage. Preveil also offers cloud storage with secure sharing, and you have a range of choices for what recipients can do, from editing and re-sharing to simply viewing the data in a viewer window. Proton Drive, a similar feature to Proton Mail, is available to all users. Proton Mail offers cloud storage starting with its free tier, but paying customers get more storage, up to 500GB.
You can set Proton Mail and Virtru messages to expire after a given time. Private-Mail and Proton Mail let you set an away message when you don’t have email access. These two also include the ability to define filtering rules. As noted, SecureMyEmail out-of-network messages automatically expire within 30 days, but there's no expiration option for in-network messages.
As noted, the free edition of Tuta Mail includes a secure calendar that syncs across all your devices. Paying for a premium account lets you create multiple calendars. Proton Mail's associated Proton Calendar is likewise available at the free level. Private-Mail also offers a calendar feature. However, in testing, Private-Mail's system for syncing that calendar proved too complex for the average user.