The most secure email providers, and what "secure" really means
"Secure email" can mean three different things. Knowing which one you need tells you whether to switch providers or simply lock down the account you have.
Quick answer
If you want email the provider itself cannot read, choose an end-to-end encrypted service such as Proton Mail (Switzerland) or Tuta (Germany). For most people, though, the biggest security gain comes from protecting the account they already have: turn on 2-Step Verification or a passkey, use a unique password, and check recovery options and forwarding rules.
Three kinds of email security
- Encryption in transit: mail is encrypted (TLS) while it moves between servers. Gmail, Outlook, Yahoo, iCloud and almost every major provider do this.
- Encryption at rest: mail is encrypted on the provider's disks. Again standard at big providers, but the provider holds the keys.
- End-to-end or zero-access encryption: only you (and your recipient) hold the keys, so the provider cannot read your messages. This is what Proton Mail and Tuta are built around.
Secure email providers compared
| Provider | Based in | What it protects | Free plan |
|---|---|---|---|
| Proton Mail | Switzerland | End-to-end encryption between Proton users; zero-access encryption for stored mail; password-protected email to anyone | Yes |
| Tuta (formerly Tutanota) | Germany | End-to-end encryption of mail, including subject lines, plus contacts and calendar | Yes |
| Mailbox.org | Germany | Privacy-focused paid service with built-in PGP encryption | No |
| Gmail | United States | TLS and encryption at rest; strong account protection, including Google's Advanced Protection Program | Yes |
| Outlook.com / Microsoft 365 | United States | TLS and encryption at rest; Microsoft 365 plans can send encrypted messages | Yes |
| iCloud Mail | United States | TLS and encryption at rest. Apple says Mail is not end-to-end encrypted, even with Advanced Data Protection | Yes (5 GB) |
To send an encrypted message from a mainstream account, see encrypting email in Gmail and in Outlook.
What end-to-end encryption does not do
- It doesn't hide everything. Who you email, when, and (with Proton) the subject line are not end-to-end encrypted.
- Mail to normal providers is only partly protected. When a Proton user emails a Gmail user, the copy in Gmail is stored the way Gmail stores everything, unless you send a password-protected message.
- Losing your password can mean losing your mail. Set up the recovery options when you sign up.
- It doesn't stop phishing. Most accounts are broken into because someone typed their password into a fake page.
How to secure any email account
- Turn on 2-Step Verification, or better, a passkey or security key.
- Use a long password you use nowhere else, stored in a password manager.
- Check your recovery email and phone are still yours.
- Look for unknown forwarding rules and filters: attackers add them to copy your mail.
- Check whether your address appeared in a breach: email data breach check.
- Learn to spot fakes: is this email legit?
Which one should you choose?
- Journalists, lawyers, activists, anyone handling sensitive information: Proton Mail or Tuta.
- Most people: stay with Gmail, Outlook or iCloud and lock the account down with the steps above.
- A business: a business plan with your own domain; see business email hosting.
Comparing everyday free services instead? Read the best free email services.
Questions people ask
- What is the most secure email provider?
- For privacy from the provider itself, end-to-end encrypted services such as Proton Mail and Tuta are the strongest common choices. For protection from hackers, any major provider is secure if you use a passkey or 2-Step Verification and a unique password.
- Is Gmail secure?
- Gmail encrypts mail in transit and at rest and has strong protection against account takeover, but Google holds the keys, so it is not end-to-end encrypted by default.
- Is Proton Mail really private?
- Proton stores your mail with zero-access encryption, so it cannot read message bodies. It can still see some metadata, such as who you email and when, and subject lines are not end-to-end encrypted.
- Is iCloud Mail end-to-end encrypted?
- No. Apple says iCloud Mail is not end-to-end encrypted, even with Advanced Data Protection turned on, because it has to work with other email systems.