Skip to content

This chapter is geared towards beginners. No particular tech skills are required.

Encrypt your emails

Email encryption

Choose a trustworthy email provider. Carefully assess aspects such as available features, encryption technologies, or server locations — privacy legislation changes from country to country. This chapter provides an (incomplete) overview of popular, privacy respecting email providers.

What about self-hosting?

Self-hosting your own email server can be an alternative, though reportedly it's a hassle for less tech-savvy users.


Protonmail

Protonmail

Protonmail claims to be the world's largest secure email service, protected by Swiss privacy laws. It's amongst others funded by US investors and the European Union. The source code is available here.

Head over to Protonmail's website to sign up. At the time of writing, the basic single user account offered 500 MB storage for free. For 4 to 24 EUR/month, you get access to more users and storage, as well as a plethora of features: calendar, contact and email imports, bitcoin payments, VPN, and more.

Some words of advice on encryption

Emails Encryption
Sent between Protonmail users Message body and attachments are end-to-end encrypted. Subject lines and recipient/sender addresses are not.
Sent from Protonmail users to other providers Message body and attachments are only end-to-end encrypted if the user selects the Encrypt for Outside option. Otherwise, only TLS encryption is applied if the receiving mail server supports it (which also means that the receiving provider can read the message). In any case, subject lines and recipient/sender addresses are not end-to-end encrypted.
Received by Protonmail users from other providers Message body and attachments are only encrypted with TLS, if the sender's mail server supports it. Subject lines and recipient/sender addresses are not end-to-end encrypted.

Mobile clients

Besides webmail access, Protonmail offers a mobile app which can be downloaded from Google's Play Store or Aurora Store! The app contains 0 trackers and requires 14 permissions. By comparison: for Gmail it's 1 tracker and 55 permissions; for Outlook it's 13 trackers and 49 permissions; and for Hotmail it's 4 trackers and 31 permissions.

Besides webmail access, Protonmail offers a mobile app. Simply download it from the App Store.

Desktop clients

Protonmail works with Thunderbird, a free, open source desktop client. This feature is only available to paid accounts, via the so-called Bridge application. More detailed instructions below.

Show me the step-by-step instructions

Install Thunderbird

Navigate to Thunderbird's download page and click on the "Free Download" button. Once the installer is downloaded, click on the "Run" button and follow the installation wizard.

Install Protonmail Bridge

Thunderbird integrates nicely with Protonmail, making sure emails stay encrypted when they enter and leave your computer. This is handled by the so-called Bridge application, available to paid users only. Download Protonmail Bridge for Windows. Once the installer is downloaded, click on the "Run" button and follow the installation wizard.

Configure Protonmail Bridge

Open the freshly installed Protonmail Bridge application and follow the setup wizard:

Steps Description
1 Log into your Protonmail account.
2 Click on your account name and then the "Mailbox configuration" button.
3 A window with the title "Protonmail Bridge Mailbox Configuration" should pop up. It displays IMAP and SMTP settings, including a password, needed later on to configure Thunderbird.

Configure Thunderbird

Now launch Thunderbird, navigate to "File ‣ New ‣ Existing Email Account" and follow the setup wizard:

Setting Description
Your name Enter the name you want others to see.
Email address Enter your Protonmail email address.
Password Copy and paste the password from the "Protonmail Bridge Mailbox Configuration" window (do not enter your Protonmail password, it won't work).
Remember password Check the "Remember Password" box to avoid re-entering the password each time you fire up Thunderbird.
Manual config Click on the "Manual config" button, and fill out the IMAP and SMTP settings provided in the "Protonmail Bridge Mailbox Configuration" window (for Authentication, select "Normal password").
Re-test Click on the "Re-test" button to verify your connection settings.
Advanced config Click on the "Advanced config" button. A new window appears. Just click on the "OK" button, do not modify any settings in this window.
Add Security Exception Click on the "Confirm Security Exception" button in the pop-up window. This confirms that your computer (127.0.0.1) can run the Bridge app. You might have to confirm a second security exception later on, once you send your first email.

Protonmail works with Thunderbird, a free, open source desktop client. This feature is only available to paid accounts, via the so-called Bridge application. More detailed instructions below.

Show me the step-by-step instructions

Install Thunderbird

Navigate to Thunderbird's download page and click on the "Free Download" button. Once the installer is downloaded, it should open by itself and mount a new volume containing the Thunderbird application. If not, open the downloaded Thunderbird .dmg file and drag the appearing Thunderbird icon on top of the Application folder. For easy access, open the Applications folder and drag the Thunderbird icon to your dock.

Install Protonmail Bridge

Thunderbird integrates nicely with Protonmail, making sure emails stay encrypted when they enter and leave your computer. This is handled by the so-called Bridge application, available to paid users only. Download Protonmail Bridge for macOS. Once the installer is downloaded, it should start by itself and mount a new volume containing the Protonmail application. If not, open the downloaded Protonmail Bridge .dmg file and drag the Protonmail icon on top of the Application folder. For easy access, open the Applications folder and drag the Protonmail Bridge icon to your dock.

Configure Protonmail Bridge

Open the freshly installed Protonmail Bridge application and follow the setup wizard:

Steps Description
1 Log into your Protonmail account.
2 Click on your account name and then the "Mailbox configuration" button.
3 A window with the title "Protonmail Bridge Mailbox Configuration" should pop up. It displays IMAP and SMTP settings, including a password, needed later on to configure Thunderbird.

Configure Thunderbird

Now launch Thunderbird, navigate to "File ‣ New ‣ Existing Email Account" and follow the setup wizard:

Setting Description
Your name Enter the name you want others to see.
Email address Enter your Protonmail email address.
Password Copy and paste the password from the "Protonmail Bridge Mailbox Configuration" window (do not enter your Protonmail password, it won't work).
Remember password Check the "Remember Password" box to avoid re-entering the password each time you fire up Thunderbird.
Manual config Click on the "Manual config" button, and fill out the IMAP and SMTP settings provided in the "Protonmail Bridge Mailbox Configuration" window (for Authentication, select "Normal password").
Re-test Click on the "Re-test" button to verify your connection settings.
Advanced config Click on the "Advanced config" button. A new window appears. Just click on the "OK" button, do not modify any settings in this window.
Add Security Exception Click on the "Confirm Security Exception" button in the pop-up window. This confirms that your computer (127.0.0.1) can run the Bridge app. You might have to confirm a second security exception later on, once you send your first email.

Protonmail works with Thunderbird, a free, open source desktop client. This feature is only available to paid accounts, via the so-called Bridge application. More detailed instructions below.

Show me the step-by-step instructions

Install Thunderbird

Open the terminal with the shortcut CTRL + ALT + T, or click on the "Applications" button on the top left and search for "Terminal". Run the following command to install Thunderbird:

sudo apt install thunderbird

Install Protonmail Bridge

Thunderbird integrates nicely with Protonmail, making sure emails stay encrypted when they enter and leave your computer. This is handled by the so-called Bridge application, available to paid users only. Download Protonmail Bridge for Linux The file should be called something similar to protonmail-bridge_X.X.X-X_amd64.deb. Let's assume it has been downloaded to the folder /home/gofoss/Downloads. Open the terminal with the shortcut CTRL + ALT + T, or click on the "Applications" button on the top left and search for "Terminal". Then run the following commands (don't forget to adjust the filename and download folder path accordingly):

sudo apt install gdebi
cd /home/gofoss/Downloads
sudo gdebi protonmail-bridge_X.X.X-X_amd64.deb

Configure Protonmail Bridge

Open the Bridge application with the terminal command protonmail-bridge, or click on the "Applications" button on the top left, and search for "ProtonMail Bridge". Follow the setup wizard:

Steps Description
1 Log into your Protonmail account.
2 Click on your account name and then the "Mailbox configuration" button.
3 A window with the title "Protonmail Bridge Mailbox Configuration" should pop up. It displays IMAP and SMTP settings, including a password, needed later on to configure Thunderbird.

Configure Thunderbird

Now launch Thunderbird, navigate to "File ‣ New ‣ Existing Email Account" and follow the setup wizard:

Setting Description
Your name Enter the name you want others to see.
Email address Enter your Protonmail email address.
Password Copy and paste the password from the "Protonmail Bridge Mailbox Configuration" window (do not enter your Protonmail password, it won't work).
Remember password Check the "Remember Password" box to avoid re-entering the password each time you fire up Thunderbird.
Manual config Click on the "Manual config" button, and fill out the IMAP and SMTP settings provided in the "Protonmail Bridge Mailbox Configuration" window (for Authentication, select "Normal password").
Re-test Click on the "Re-test" button to verify your connection settings.
Advanced config Click on the "Advanced config" button. A new window appears. Just click on the "OK" button, do not modify any settings in this window.
Add Security Exception Click on the "Confirm Security Exception" button in the pop-up window. This confirms that your computer (127.0.0.1) can run the Bridge app. You might have to confirm a second security exception later on, once you send your first email.

Show me a summary video

This video explains how to add a Protonmail account to Thunderbird in Windows. Instructions should similarly apply to macOS or Linux.

Courtesy of Protonmail.

Support

For further details or questions, refer to Protonmail's support or Thunderbird's documentation. Also feel free to ask the Protonmail community or Thunderbird community for help.


Tutanota

Tutanota

Tutanota is a freemium hosted secure email service, registered in Germany. Everything is end-to-end encrypted and open-source. Tutanota uses its own encryption standard, and does not support PGP.

Head over to Tutanota's website to sign up. At the time of writing, the basic account offered 1 GB storage for free. For approximately 1 to 6 EUR/month, you get access to more users and storage, as well as a plethora of features: custom domains, unlimited search, multiple calendars, inbox rules, whitelabel, calendar sharing, etc. Email imports and anonymous payment are currently not supported.

Mobile clients

Besides webmail access, Tutanota offers a mobile app which can be downloaded from Google's Play Store. Alternatively, visit Tutanota's download page or Tutanota's Github repository to download and install the .apk file. Tutanota is also available on F-Droid or Aurora Store, two alternative app stores. The app contains 0 trackers and requires 9 permissions. By comparison: for Gmail it's 1 tracker and 55 permissions; for Outlook it's 13 trackers and 49 permissions; and for Hotmail it's 4 trackers and 31 permissions.

Besides webmail access, Tutanota offers a mobile email application. Simply download it from the App Store.

Desktop clients

Tutanota developed its own dedicated desktop client for Windows. More detailed instructions below.

Show me the step-by-step instructions

Simply download the installer, then click on the "Run" button and follow the installation wizard.

Tutanota developed its own dedicated desktop client for macOS. More detailed instructions below.

Show me the step-by-step instructions

Simply download the installer, which should open by itself and mount a new volume containing the Tutanota application. If not, open the downloaded Tutanota .dmg file and drag the appearing Tutanota icon on top of the Application folder. For easy access, open the Applications folder and drag the Tutanota icon to your dock.

Tutanota developed its own dedicated desktop client for Linux. More detailed instructions below.

Show me the step-by-step instructions

Simply download the installer, which should be called something like tutanota-desktop-linux.AppImage. Let's assume it was downloaded to the folder /home/gofoss/Downloads. Open the terminal with the CTRL + ALT + T shortcut, or click on the "Applications" button on the top left and search for "Terminal". Then run the following commands (don't forget to adjust the filename and download folder path accordingly):

cd /home/gofoss/Downloads
chmod +x tutanota-desktop-linux.AppImage
Show me how to pin Tutanota to the Ubuntu dock

It's not straight forward, but Tutanota's launcher can be added to Ubuntu's application menu and pinned to the dock. Open the terminal with the CTRL + ALT + T shortcut, or click on the "Applications" button on the top left and search for "Terminal". Run the following command:

sudo gedit /usr/share/applications/tutanota.desktop

Paste the following content into the newly created file. Make sure to point the Exec path towards the folder containing the downloaded AppImage:

#!/usr/bin/env xdg-open
[Desktop Entry]
Version=1.0
Type=Application
Terminal=false
Exec=/home/gofoss/Downloads/tutanota-desktop-linux.AppImage
Name=Tutanota

Make the file executable:

sudo chmod +x /usr/share/applications/tutanota.desktop

Log off and back into your Ubuntu session. You should now be able to launch Tutanota from the application menu, and pin it to the dock.

Support

For further details or questions, refer to Tutanota's documentation or ask the Tutanota community.


Email providers

Other providers

Info Description
Website disroot. org
Pricing Basic account is free (1 GB storage); extra storage for 0.15 EUR per GB per month.
Features Platform providing online services based on principles of freedom, privacy, federation and decentralization. Located in the Netherlands. Accepts bitcoin and faircon. Full disk encryption & email encryption. Mobile app.
Anti-features Can potentially decrypt user data, as emails are reportedly stored in plain text.
Info Description
Website mailbox. org
Pricing 1 EUR/month, 2GB storage.
Features German open source email provider, with servers located in Berlin. Offers security features such as encryption at rest, PGP, DANE, SPF and DKIM, as well as two-factor authentication, full text search, calendars, address books and task lists, CalDAV and CardDAV synchronisation.
Anti-features No mobile client, need for 3rd party clients.
Info Description
Website posteo.de
Pricing 1 EUR/month, 2GB storage.
Features German open source email provider, self-financed, encryption at rest, two-factor authentication, calendars and address books, CalDAV and CardDAV synchronisation.
Anti-features No spam folder, no trial or free version.
Info Description
Website kolabnow.com
Pricing 5 USD/month, 2GB storage.
Features Swiss open source email provider, text search and tagging, filters, address books, calendars, CalDAV and CardDAV synchronisation.
Anti-features No built-in end-to-end encryption, not encryption at rest.
Info Description
Website startmail.com
Pricing 5 USD/month, 10GB storage.
Features Dutch privacy laws apply. Encryption, disposable email addresses.
Anti-features No mobile apps, not open source.
Info Description
Website mailfence.com
Pricing Basic account is free, 500MB storage.
Features OpenPGP encryption, two factor authentication, features calendar, address books, online document editing.
Anti-features Not open source, logging of IP addresses, no encryption at rest.


Email forwarding

Transition period

Forward emails

Transitioning to a new email account can take some time. You'll probably want to keep your old accounts alive for a while to make sure you don't miss out on anything. Just forward any incoming message to the new account:

Update subscriptions

Use the transition period to scan your old email accounts for any active subscriptions and update your new email address!

Inform contacts

Don't forget to communicate the new email address to your personal and professional contacts, bank, insurance, tax office, and so on. You might also want to set up an auto-reply message on your old account to keep folks informed about the change of address.

Terminate the old account

Over time, less and less emails will land in your old inbox. Eventually, it will become inactive. That's when you should consider terminating your old email account.


Secure Emails